CVE Vulnerability Catalog

In RabbitMQ, the stream open handler calls only check_vhost_access, omitting the node/vhost/user connection-limit checks that rabbit_reader performs for AMQP. An authenticated tenant can fully bypass operator-configured per-user and per-vhost connection caps by connecting via port 5552 instead of 5672.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. It contains no vulnerability information.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. It contains no vulnerability information.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. It contains no vulnerability information.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. It contains no vulnerability information.

A flaw was found in librsvg where processing an SVG document with nested XML inclusions (Xincludes) and duplicate entity declarations can cause a use-after-free. The library incorrectly frees an XML entity still in use by the parser. An attacker could exploit this to cause a denial of service or execute arbitrary code.

The W4 Post List plugin by Shazzad Hossain Khan in versions up to 3.0.6 contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This allows Blind SQL Injection attacks.

In sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8, the MD5.getMD5 function in MD5.java uses a one-way hash without salt for user password handling. The attack can be initiated remotely, though it requires high complexity and is assessed as difficult.

A vulnerability was found in the sfturing hosp_order project in an unknown function of ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java. Manipulation leads to cross-site request forgery, and the attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

In sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8, the getProperties function in MailUtil.java results in cleartext transmission of sensitive information. The attack can be initiated remotely, though it requires high complexity and is assessed as difficult.

Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake UI elements, such as a spoofed address bar, misleading the user about the origin of displayed content.

WP Toolkit for cPanel versions 6.11.2-10794 and earlier contains an argument injection vulnerability that allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.

cPanel contains an execution with unnecessary privileges vulnerability that allows remote authenticated users to execute arbitrary code with root privileges.

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.

Klever-Go prior to 1.7.20 exposes a default-open GET /subscribe endpoint that accepts unauthenticated WebSocket clients with permissive origin handling, no message size limit, and no live-connection cap. A single client can grow subscription maps, and many clients can retain goroutines, buffered channels, and descriptors, leading to memory or scheduler exhaustion.

Klever-Go prior to 1.7.20 exposes a default-open GET /log WebSocket route that does not require authentication. The first client message is parsed as a logger Profile and applied process-wide, allowing a remote client to change global log levels and formatting options and receive live process logs.

In Ansible Automation Platform automation controller, the external logging (rsyslog) configuration is generated by interpolating user-controlled settings into an rsyslog RainerScript config file without neutralizing RainerScript syntax. A privileged user can inject rsyslog directives, including an omprog action, causing arbitrary command execution inside the control-plane rsyslog component.

An argument-injection flaw exists in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without integer validation, and the dispatcher flattens the management-command argument list into a single space-separated string, so spaces become additional arguments. An authenticated superuser can inject arbitrary arguments, including Python's path option, into the awx-manage process.

A server-side request forgery flaw exists in the Ansible Automation Platform automation-controller email notification backend. The backend passes the user-supplied SMTP host and port from a notification template directly to the SMTP client without validating that the target is not an internal, loopback, link-local, or reserved address. An authenticated user with organization notification-admin permission can create a template pointing at an arbitrary internal address and trigger a test, opening a raw TCP connection.

In Ansible Automation Platform automation-controller, the WorkflowJobNode.ancestor_artifacts database column, storing raw merged set_stats artifacts propagated between workflow nodes, is not wrapped in prevent_search() and is accepted for arbitrary field lookups by the REST filter backend, even though it is omitted from the API serializer. Because the column is persisted before Ansible's no_log masking is applied, a user with read access to a workflow can use the result count as an oracle to recover, character by character, values marked no_log.