CVE Vulnerability Catalog

In Goobi viewer, SolrTools.cleanUpQuery() strips Solr local-parameter syntax ({!...}) from user-supplied query strings before they reach Solr. Its regex can be bypassed by wrapping the local parameter in a second pair of curly braces ({{!...}}): the outer braces are stripped, the inner {!...} survives intact, and a valid Solr local parameter is forwarded. The flaw is in the shared sanitizer, so it affects any endpoint that routes user input through cleanUpQuery.

Isar is an integration system for automated root filesystem generation. In versions 0.11 and newer, /etc/apt/trusted.gpg.d is created manually during bootstrap setup to deploy local keys, so the directory is owned by the calling user instead of root. If the calling user's id matches an unprivileged user inside the image, that user can alter existing keys and deploy new ones, silently breaking apt repo integrity protection.

Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a user enumeration vulnerability allows an attacker to identify valid usernames on the Cacti service. On login attempts, the application returns slightly different error messages depending on whether the provided username exists — the only difference is the capitalization of the letter "f" in the word "failed".

Cacti contains an authenticated stored second-order SQL injection in the automation tree rule item handler. A user holding the Automation realm (default General Administration role) can persist an arbitrary SQL fragment in the automation_tree_rule_items.field column, which is later concatenated directly into a SELECT ... AS source FROM ... clause in lib/api_automation.php :: create_all_header_nodes() and executed when an administrator triggers automation via the "Apply Automation Rules" bulk action. The injected SELECT result is written into graph_tree_items.title and rendered in the Cacti tree UI, providing a direct exfiltration channel.

In Goobi viewer before version 26.05, when a password reset link is visited, the application generates a replacement password in a predictable way and emails it to the account holder. The insufficient entropy allows the password to be brute-forced by an attacker who can approximate the server-side generation time.

In Goobi viewer before version 26.05, the password reset token is predictably based on the time of the reset request. An attacker who knows the target's email address can request a reset and then brute-force the token. Exploiting this finding alone forces an unauthorized password reset on any account.

GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored by ReportScheduling.btnSaveReport_Click() without output encoding and is executed in the browser of the user who created the scheduled report when they subsequently view the MailInsights page.

A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that inserts the parameter into a hidden input attribute without HTML encoding. A victim who opens the URL receives attacker-controlled script and page content under the legitimate Zimbra origin, allowing credential capture through a replacement login form.

An LDAP filter injection vulnerability in Zimbra Collaboration Suite allows an authenticated user to query otherwise unreturned attributes of calendar resources through SearchCalendarResourcesRequest. Zimbra escapes search values but inserts the supplied attribute names directly into LDAP filter expressions without validation. An attacker can inject additional conditions and use repeated matching queries to recover readable resource attributes such as internal mailbox hostnames and mail transport routes.

A cross-account authorization vulnerability in Zimbra Collaboration Suite allows an authenticated user to insert forged shared-file records into another user's mailbox through FileSharedWithMeRequest. The request bypasses delegated-account authorization and accepts attacker-selected file metadata, owner identifiers and declared sizes without validating a corresponding document share. An attacker can plant entries attributed to another real local account without that account sharing a document. No victim interaction is required.

A CSS sanitization vulnerability in Zimbra Collaboration Suite allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content under the Zimbra origin. When processing a stylesheet containing non-ASCII characters, DefangFilter appends the final ASCII segment without sanitizing it. HTML stored as application/x-zimbra-doc can therefore retain CSS URL references that the normal sanitizer removes. An attacker can share a crafted document that loads external resources and displays a credential-collection form using Zimbra's own visual assets.

A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite allows an unauthenticated sender to bypass the restriction on forms that target the Zimbra host. DefangFilter and the OWASP ActionAttributePolicy compare the form-action hostname with the request hostname before browser URL canonicalization. A percent-encoded hostname can therefore survive sanitization while the browser submits the form to the normal Zimbra origin with the recipient's authentication cookie. This permits authenticated form requests from a crafted email after the recipient opens it in Classic and submits the form.

An organizer authentication vulnerability in Zimbra Collaboration Suite allows an unauthenticated email sender to insert calendar invitations attributed to another user. The email delivery path permits external invitations but does not verify that the message sender is authorized to use the iCalendar ORGANIZER identity. When automatic invitation insertion is enabled, a crafted REQUEST component creates an event containing attacker-selected meeting details and reminders under a forged organizer without recipient interaction. No corresponding event is created in the claimed organizer's calendar.

An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite allows an unauthenticated sender to forge another attendee's response to an existing meeting. Zimbra passes a null sender identity when processing iCalendar REPLY components, causing the attendee authorization filter to be skipped. An attacker who knows the meeting UID, organizer address and attendee address can send a non-outdated reply that changes the attendee's participation status in the organizer's calendar. The change occurs automatically during delivery without organizer or attendee interaction.

An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite allows an unauthenticated sender to cancel or modify an existing meeting in a recipient's calendar. Zimbra accepts iCalendar CANCEL and REQUEST components without verifying that the email sender is authorized to act as the supplied organizer. An attacker who knows the meeting UID and organizer address can supply a non-outdated sequence number to move the recipient's meeting to Trash or replace its details. Processing occurs automatically during email delivery without recipient interaction.

Entire CLI before version 0.7.7 contains a path traversal vulnerability. Malicious checkpoint metadata fetched from the remote branch can cause transcript data to be written outside the expected session directory, overwriting arbitrary files on the victim's machine.

NetBox MCP Server before version 1.2.1, when running with TRANSPORT=http, has no authentication on the HTTP endpoint. Any client that can reach the port obtains a valid MCP session and full access to all NetBox tools without a token.

In odhcpd versions 25.12 and prior, DHCPv6 self-loop detection uses a network-byte-order DUID length value as the memcmp() size parameter. On little-endian hosts, a single unauthenticated DHCPv6 packet triggers a 2560-byte overread from a 128-byte buffer.

Zimbra Collaboration Suite (ZCS) contains a mailbox quota-accounting vulnerability. An authenticated user can repeatedly share and revoke a document to permanently consume another user's mailbox quota.

An SMTP command injection vulnerability exists in the data-source testing functionality of Zimbra Collaboration Suite (ZCS). An authenticated user can inject CR/LF into the emailAddress in an SMTP envelope command, and after a successful POP3 or IMAP login Zimbra sends the injected commands to the SMTP service.