CVE Vulnerability Catalog

Unauthenticated PHP Object Injection vulnerability in Mail Mint versions up to 1.31.0. An attacker can inject malicious PHP objects, potentially leading to arbitrary code execution.

Unauthenticated Broken Access Control vulnerability in YITH Request a Quote for WooCommerce Premium versions before 4.46.0. An attacker can access functions they should not have permission to.

MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to null, which when passed to cURL effectively disabled TLS peer verification unless the calling code explicitly enabled it. As a result, HTTPS connections made through affected CurlClient instances could accept certificates that were not issued by a trusted certificate authority.

MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. An attacker knowing a valid directory user's email address could submit an empty password, which may be accepted by an LDAP server allowing unauthenticated binds. Additionally, in the LinOTP component, empty passwords could be checked against local MISP password hashes, and LDAP-provisioned accounts could be created with empty local passwords.

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and action callbacks without CSRF protection.

CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access.

A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formLogin of the file /boaform/formLogin of the component Boa Web Server. Executing a manipulation of the argument Username can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFilter parses an X.509 certificate that the client sends inside the MQTT message payload and treats its Subject DN as the authenticated identity. The certificate is decoded but its signature is never verified and its issuer chain is never validated against any trust store. An attacker who can publish to the MQTT broker can mint a self-signed certificate with CN=Sysop.<cloud>.<org>.arrowhead.eu and dnQualifier=op to gain full management access over MQTT.

n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers in spread, computed-key, switch-case, or class-extension positions resolve against process globals. Authenticated users with workflow-edit permission can mutate host objects through expression evaluation, with changes persisting process-wide until restart.

WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a video_id_hash can replay it indefinitely to authenticate as the video owner with full privileges, and the credential remains valid even after the owner changes their password.

A vulnerability was found in TOTOLINK CP450 4.1.0 in an unknown function of the file /cgi-bin/cstecgi.cgi. Manipulating the topicurl argument results in a buffer overflow. Remote exploitation is possible.

In the Linux kernel's KVM subsystem (x86 MMU), a use-after-free vulnerability was found. The issue stems from violating the invariant that invalid shadow pages are not on the active MMU page list, leading to incorrect use of list_add() instead of list_move() when processing an invalid shadow page. The fix explicitly clears role.invalid when creating a child shadow page and adds a WARN if the parent is invalid.

Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0 - The cid parameter is used in queries without validation, allowing SQLi vectors.

Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - J2StoreControllerApps's appTask delegation path instantiates app-plugin controllers with no ACL check anywhere in the code. Additionally, applocalizationdata::getInstallerTool() used a caller-influenced table name with no allow-list, enabling path-traversal-capable file read/execute.

A stored Cross-Site Scripting (XSS) vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with administrator privileges can input malicious HTML content which is subsequently stored and displayed without proper sanitisation when other administrators access the template customisation view, allowing JavaScript code to be executed within the application’s security context and potentially compromising the sessions of other users with administrative privileges.

Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admin_info endpoint. The application validates files solely based on the client-provided name without checking content or restricting file types. An administrator can upload PHP files to a web-accessible directory, potentially leading to arbitrary code execution.

Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.

In Submariner's cert-auth mode, connection configuration is built from unvalidated free-form strings from the CRD. A malicious cluster can publish a CableName with newlines and ipsec.conf directives, allowing injection of arbitrary configuration or command execution via leftupdown hooks, leading to remote code execution as root on the gateway node.

In the PREVAIL eBPF verifier before version 0.2.4, the abstract transformer treats writes through a T_CTX-typed base register as a silent no-op. An attacker can craft an eBPF program that overwrites a context field, reloads it as T_PACKET, and dereferences an attacker-controlled address, and PREVAIL will report the program as safe.

In the PREVAIL eBPF verifier before version 0.2.4, EbpfTransformer::add() silently skips offset-variable updates when the destination register carries a non-singleton typeset. Subsequent bounds checks use the stale offset and accept out-of-bounds memory accesses, so a crafted BPF program passes verification even though it would corrupt memory at runtime.