CVE Vulnerability Catalog

In Frogman prior to version 1.6.2, the fm_dialplan_apply function accepted template parameters (greeting, dest, url, extension, code, file) without proper sanitization, allowing a PERM_WRITE caller with confirm:true to inject arbitrary Asterisk directives such as System(), Set(SHELL(...)), Goto, or Macro. This issue is fixed in version 1.6.2.

HireFlow versions 1.2 and earlier use a hard-coded Flask secret_key for signing session cookies. Knowing this publicly available value, an unauthenticated attacker can forge cookies with role=admin and arbitrary user_id, bypassing authentication.

Grafana OnCall through version 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stack_id and org_id values present in the public source tree. Attackers can leverage the acquired token to authenticate against all internal API endpoints, create arbitrary Admin users via the user-context header bootstrap path, revoke the legitimate plugin token, and redirect OnCall-to-Grafana API calls to an attacker-controlled host by overwriting the organization's grafana_url and api_token.

The vulnerability in the XML::Bare library for Perl (versions up to 0.53) is due to unbounded character lookahead in the parserc_parse function. This function does not check that offsets are within the buffer, which can cause an out-of-bounds read with truncated strings like "<a/".

A vulnerability in the HTML::Bare library for Perl (versions up to 0.04) is caused by unbounded character lookahead. The parserc_parse function fails to check that offsets are within the buffer when searching for multicharacter strings like "<![CDATA" or element terminators like ">". Truncated strings such as "<a/" can trigger an out-of-bounds read.

A vulnerability in Yamcs before version 5.12.7 allows an authenticated user with ChangeMissionDatabase privilege to achieve remote code execution by overriding Python algorithms in the Jython script engine. Lack of sandboxing enables importing and executing arbitrary Java classes, including java.lang.Runtime.

In Yamcs before version 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text was constructed without a ClassFilter, allowing a user with ChangeMissionDatabase privilege to override an algorithm and supply JavaScript that reaches arbitrary Java classes to execute arbitrary OS commands. In the default configuration with no security.yaml, the built-in guest user has superuser=true, making the issue reachable without authentication.

A vulnerability in zrok before version 2.0.3 allows an attacker to pass an absolute URL in the request path to the Flask proxy route of the Python SDK. The urllib.parse.urljoin function enables replacing the configured target host, causing the server to make a request to an attacker-chosen URL.

Yamcs before version 5.12.7 has a server-side code injection vulnerability in the algorithm evaluation engine. An authenticated user with ChangeMissionDatabase privilege can override an existing algorithm via the REST API and inject Java code, leading to remote code execution on the host.

The Perl library Image::EPEG up to version 0.15 includes an unsupported version of the Epeg library (0.9.0), which has not been updated since 2004. Using outdated software may expose unpatched security vulnerabilities.

Kiota before versions 1.29.1 and 1.32.5 did not sanitize clientClassName and clientNamespaceName values from OpenAPI descriptions, allowing generated source to be written outside the output directory and arbitrary text to be injected into class or namespace declarations.

Kiota before versions 1.29.1 and 1.32.5 displayed dependency install commands from an OpenAPI description as recommended, allowing command injection when the suggested command was run manually or via the VS Code extension.

Kiota before versions 1.29.1 and 1.32.5 in plugin add and plugin generate commands did not validate paths in the static_template.file field, allowing path traversal or out-of-package file inclusion in generated plugin manifests.

The Microsoft 365 and Microsoft Entra ID Plugins for Moodle have a vulnerability in the Teams SSO endpoint (sso_login.php) that base64-decodes a JWT payload and authenticates users from the upn claim without verifying the JWT signature. An unauthenticated attacker can forge a token and obtain a Moodle session as an O365-authenticated user.

Kopia prior to 0.23.0, when the HTTP server is started with --without-password, accepts unauthenticated requests to /api/v1/repo/exists and forwards attacker-supplied SFTP storage configuration to blob.NewStorage. Setting externalSSH: true and sshArguments containing -oProxyCommand=<cmd> causes exec.CommandContext("ssh") to invoke the command through OpenSSH.

The vulnerability in SGLang involves an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface without authentication or deserialization safeguards. This allows an attacker to provide a malicious pickle file, resulting in unauthenticated remote code execution when the feature is enabled and the service is reachable over the network.

An input validation vulnerability in ubuntu-pro-client (formerly ubuntu-advantage-tools) allows injection of arbitrary APT repository configurations and installation of malicious packages with root privileges. The issue stems from missing validation of contract server data used to generate APT source files and execute apt-get install commands.

An unauthenticated remote attacker can execute remote code due to improper sanitization of user input in the SetParameter command.

An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the origin of a communication channel.

An authentication bypass vulnerability due to a primary weakness in Spring Authorization Server. Affects versions from 7.0.0 to 7.0.4, from 1.5.0 to 1.5.6, from 1.4.0 to 1.4.9, and from 1.3.0 to 1.3.10.