CVE Vulnerability Catalog

Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.

Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.

Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network.

Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.

A vulnerability in D-Link DNS-320 ShareCenter 2.06B01 affects the file /cgi/file_sharing.cgi of the File Sharing component. Manipulating the argument fileurl leads to OS command injection. The attack can be launched remotely, and the exploit has been publicly disclosed.

A vulnerability in D-Link DNS-340L 1.01B04 affects the file /cgi-bin/dropbox.cgi of the CGI Handler component. Manipulating the arguments callback_url/sync_interval results in OS command injection. The attack can be initiated remotely, and the exploit has been made public.

A vulnerability in D-Link DNS-340L 1.01B04 affects the file /cgi-bin/addon_center.cgi of the Add-On Center component. Manipulating the arguments f_name/f_url/f_flag/f_login_user leads to OS command injection. The attack can be launched remotely, and the exploit has been disclosed to the public.

MapLibre GL JS prior to 6.4.1 has a vulnerability in DOM.sanitize() in src/util/dom.ts, which iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, causing an attribute such as onload or ontoggle to survive sanitization and execute when the attribution control inserts the content into innerHTML. A victim must render the affected map content for the script to execute. This issue is fixed in version 6.4.1.

Out of bounds write in WebGL in Google Chrome on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Improper input validation in Transactions Platform in Google Chrome on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Google Chrome prior to version 152.0.7977.82 has an incomplete cleanup vulnerability in the Network component. A remote attacker could bypass system access restrictions via crafted network traffic. (Chromium security severity: High)

Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricted. This is an incomplete fix for CVE-2024-33663.

Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentials.

R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the index name parameter in the vector index creation endpoint. The index name is interpolated directly into a CREATE INDEX statement via string formatting without identifier quoting or allowlist validation, enabling arbitrary DDL and DML execution through semicolon-separated statements under the PostgreSQL superuser account.

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing (FEATURE_SECURE_PROCESSING) and without disabling Java extension functions (ALLOW_EXTERNAL_FUNCTIONS). Any stylesheet loaded by GeoNetwork can therefore invoke java.lang.Runtime.exec() or java.lang.ProcessBuilder directly, achieving arbitrary command execution as the GeoNetwork process user. A user with sufficient privileges to upload a formatter can deliver a .xsl file containing Java extension call that execute arbitrary OS commands with the privileges of the GeoNetwork process. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.

Unauthenticated PHP Object Injection vulnerability in JobSearch versions up to 3.2.0. An attacker can inject malicious PHP objects, potentially leading to arbitrary code execution.

Subscriber privilege escalation vulnerability in Bricksforge versions up to 3.1.8.8, allowing a subscriber to escalate privileges.

Unauthenticated SQL Injection vulnerability in GeoDirectory versions up to 2.8.174. An attacker can inject SQL queries, potentially leading to unauthorized database access.

Unauthenticated SQL Injection vulnerability in VikAppointments Services Booking Calendar versions up to 1.2.20. An attacker can inject SQL queries, potentially leading to unauthorized database access.