CVE Vulnerability Catalog

Termix from version 2.4.0 to 2.5.1 accepted the account password as the sole reauthentication factor in endpoints for disabling TOTP and regenerating backup codes. The refactor regressed the two-factor check, allowing an attacker with a victim's session and knowledge of the password to disable 2FA without access to an authenticator.

Termix from version 1.7.0 to 2.5.1 derived keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt. An attacker with an offline SQLite database copy can derive the wrapping key and decrypt stored SSH passwords, private keys, and key passphrases.

Snipe-IT before 8.7.0 allows an authenticated user with file-management access to upload XML and XSLT attachments and request them with inline=true. The browser can process an attacker-controlled xml-stylesheet reference and execute JavaScript generated by the stylesheet in the Snipe-IT origin. A victim must open the attachment URL, after which the script can read same-origin data and perform authenticated actions with the victim's privileges.

Snipe-IT before 8.7.0 allows a password-authenticated session for an account with self.api permission to reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web middleware group but not the API middleware group. The resulting token can read and modify resources with the victim's permissions and, for an administrator, can reach the users/two_factor_reset endpoint, allowing account takeover.

Snipe-IT before 8.7.0 allows a user with customfields.create permission to store markup in CustomField.name, which is assigned as an unescaped bootstrap-table header title. When another user opens an asset-list page, the stored markup executes on page load in that user's session, potentially exposing same-origin data and performing authenticated actions, including privilege escalation.

The @bsv/wallet-toolbox, @bsv/wallet-toolbox-client, and @bsv/wallet-toolbox-mobile packages in versions from 1.1.47 to 2.3.3 (for the first two) and from 1.3.21 to 2.3.3 (for the third) have a vulnerability that causes transactions created through a remote StorageClient to trust output locking scripts returned by the storage provider without verifying they match the requested outputs. A malicious provider can substitute a recipient script or inject an additional output, redirecting funds while the UI displays the intended recipient.

phpMyFAQ before 4.1.6 has a vulnerability in the StopWords::add() method that builds a SQL INSERT statement using sprintf() and inserts the user-supplied stop word value directly into the query without calling the database escaping function. An authenticated administrator can submit a crafted value that breaks out of the SQL string literal and injects arbitrary SQL, including dropping tables, exfiltrating data, or modifying other rows.

phpMyFAQ before version 4.2.0-alpha is vulnerable to SQL LIKE wildcard injection in the chat user search. An authenticated user can bypass the display-name search filter and enumerate active users, as % and _ are not escaped.

SumatraPDF before version 3.6 has a vulnerability in the MobiDoc::ParseHeader function, where the decoder is sized for a fixed length rather than the actual buffer length. A malformed MOBI file can cause a read beyond a short heap buffer, leading to application crash.

DbGate up to version 7.2.5/7.3.1-premium-beta.1 has a path traversal vulnerability in the fs.readFile function in packages/api/src/controllers/files.js. Manipulation of the filePath/uri arguments allows an attacker to remotely read arbitrary files outside the allowed directory.

A code injection vulnerability was found in DbGate up to version 7.2.5-beta.5 in the JSON Runner component. Manipulating the comment.text/script.schedule arguments in packages/api/src/controllers/runners.js can lead to remote code execution. Upgrading to version 7.2.5-beta.6 mitigates the issue.

A reflected XSS vulnerability exists in the CirrusSearch extension for MediaWiki due to improper input neutralization during web page generation. The issue affects versions up to and including 1.46.0.

MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges.

An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party controlling name resolution and host responses to write beyond a heap buffer, potentially causing the application to terminate unexpectedly.

A deserialization vulnerability in the command monitoring support of the MongoDB PHP Driver can cause class names from document content to be honored when building monitoring events. An attacker controlling data in database operations may instantiate application classes implementing the persistable interface and invoke their unserialize method.

Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. An authenticated user who can influence the owner value may take over or prematurely expire a lock held by another process, leading to duplicated or conflicting operations.

An out-of-bounds read in libXi's XQueryDeviceState() before version 1.8.4 could be exploited by an attacker. The description is incomplete, but the vulnerability may lead to information disclosure or a crash.

In Dokploy prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from patch.ts into a shell command in patch-repo.ts without safe argument quoting. An authenticated organization member with service:read permission can inject shell metacharacters into repoPath and execute arbitrary commands through child_process.exec as root in the Dokploy container. Because the standard deployment mounts /var/run/docker.sock, container-root command execution can be used to control Docker and compromise the host and its managed applications. This issue is fixed in version 0.29.13.

In the Linux kernel, the error path of device_register() in i3c_master_register_new_i3c_devs() fails to clear desc->dev->desc and desc->dev before releasing the device. This triggers a WARN_ON and leaves a dangling pointer to freed memory, potentially causing a use-after-free.

A flaw in the Linux kernel's ksmbd module related to DACL permission checks has been fixed. The access control logic did not consider an Authenticated Users ACE (S-1-5-11), causing files accessible to authenticated users to incorrectly fail with STATUS_ACCESS_DENIED. Additionally, maximal access calculation combined access masks from all ACEs regardless of whether their SID applied to the current user, potentially granting rights belonging to unrelated principals.