CVE Vulnerability Catalog

Part-DB prior to version 2.13.2 contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with import permission can import a CSV file containing formula-prefixed values, such as =1+1, into user-controlled part fields. When the part is later exported as an XLSX spreadsheet, Part-DB writes the value using setCellValue() without neutralizing formula characters, so the exported file may contain an executable formula that could be evaluated by another user's spreadsheet software.

Part-DB prior to version 2.13.2 allows authenticated API users to bypass the configured maximum attachment file size by uploading attachments through the API using base64-encoded file data. The application enforces the size limit for normal browser-based uploads, but the API base64 upload path does not apply the same validation. As a result, an authenticated user with API access and permission to create attachments can upload files larger than the configured maximum, potentially exhausting disk space and causing a denial of service.

Part-DB prior to version 2.13.2 allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download external file” attachment feature. When server-side attachment downloads are enabled, Part-DB downloads the remote file and streams it directly to disk without enforcing the MAX_ATTACHMENT_FILE_SIZE limit. As a result, an authenticated user who can create or edit attachments can cause Part-DB to store files larger than the configured maximum, potentially exhausting disk space and causing a denial of service.

Part-DB prior to version 2.12.3 sanitizes SVG files based solely on the user-controlled filename extension rather than the actual file content type. An authenticated attacker can upload a malicious SVG with a JavaScript payload using a non-SVG extension (e.g., .jpg), bypassing sanitization entirely. When any user views the attachment inline, the browser receives Content-Type: image/svg+xml and executes the embedded script in the Part-DB origin.

Lookyloo prior to version 1.39.4 allows an unauthenticated user to trigger the “report a capture” email on demand (which is expected). The /json/<uuid>/report API endpoint (CaptureReport) incorrectly passes the email and comment parameters, overwriting as_admin. When True, as_admin triggers a search query on a MISP instance (if configured) and adds a list of matching URLs to the email sent to the analyst (not the submitter, so there is no risk of information leakage). This could potentially cause a DoS on the MISP instance.

OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, for example to delete accounts from the BMC's Redfish service.

OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident}, i.e., not using the specific maintenance endpoint.

In Part-DB before version 2.12.2, BOM validation messages are rendered using Twig's |raw filter and include translated placeholders populated with user-controlled Part names. A user who can edit a Part name can store HTML markup that is rendered in another user's BOM validation result page, resulting in cross-user stored HTML injection.

In Part-DB before version 2.12.1, the committed .env file contains a fixed APP_SECRET value that the official jbtronics/part-db1 Docker image does not override or randomize at container start-up. Since Symfony uses APP_SECRET as the HMAC key for signing remember-me cookies, an attacker who knows the secret can forge an arbitrary-user remember-me cookie and gain a fully authenticated session without credentials.

Part-DB, an open source inventory management system for electronic components, prior to version 2.12.1 contains a stored XSS vulnerability. The LogEntryExtraFormatter class in the CollectionElementDeleted branch interpolates getOldName() and getCollectionName() into HTML without htmlspecialchars(), allowing a low-privileged content editor to store an HTML/script payload as the name of a sub-element and have it executed in the browser of a higher-privileged victim viewing the activity log or element history.

OpenStack Ironic through version 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, also known as a gzip bomb.

In HospitalManagement (gedelumbung) up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8, the simpan function in application/modules/admin/controllers/routing_pages.php does not properly validate the url_route argument, leading to an open redirect.

In HospitalManagement (gedelumbung) up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8, the simpan function in application/modules/admin/controllers/routing_pages.php does not properly handle the content argument, leading to cross-site scripting (XSS).

In the iscsiuio component of open-iscsi, the DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.

A cross-site scripting (XSS) vulnerability was found in the gedelumbung HospitalManagement application, specifically in the kirim function of application/modules/web/controllers/contact.php within the Contact Form component. Manipulating the nama, email, alamat, telepon, or pesan arguments can lead to script execution. The attack can be performed remotely, and a public exploit has been disclosed.

Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid for authenticated access for an extended period.

A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly sanitize symbolic and hard link targets pointing to absolute paths or to sibling directories of the extraction destination. An attacker who supplies a malicious container image can exploit this vulnerability by embedding links, and a chained file entry, that reference locations outside the intended extraction directory. This allows the attacker to write attacker-controlled content to arbitrary locations on the host filesystem with the privileges of the user running the command, potentially leading to file modification outside the destination directory.

A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assigned to other users or services. This issue occurs because FreeIPA verifies ownership solely by matching the host name to the certificate's subject Common Name (CN), without confirming actual ownership in the directory service. Consequently, an enrolled host can disrupt services by revoking certificates belonging to other entities.

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled request_uri parameter to the abstract get_request_object() hook before applying a destination or registration policy; the hook itself performs no network request, while the documentation demonstrates an unrestricted HTTP fetch. In deployments whose integrator implements that hook as an unrestricted outbound fetch, a remote attacker who knows a valid public client identifier can make the authorization server request internal, link-local, or otherwise unintended URLs and can distinguish fetch outcomes through different error responses and timing. Deployments whose custom hook already applies a secure allowlist, destination controls, and retrieval limits are not affected. The JWTAuthenticationRequest implementation in authlib/oauth2/rfc9101/authorization_server.py forwards request_uri to get_request_object() before an application-approved retrieval policy accepts the destination. This issue is fixed in version 1.9.0.

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validate_authorization_request() checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client permitted an ID token response type but not the openid scope can add openid to the request, obtain user consent, and receive a signed ID token containing the user's subject and allowed profile claims. Authorization code flow and deployments that allow openid for every client permitted an ID token response are not affected. In authlib/oidc/core/grants/implicit.py, OpenIDImplicitGrant.validate_authorization_request() checks request.payload.scope instead of the filtered request.scope. This issue is fixed in version 1.9.0.