CVE Vulnerability Catalog

In Brocade SANnav versions before 3.0.1a, insecure access controls on internal service ports allow local, non-administrative host users to communicate directly with backend management services. A local attacker can leverage this exposed access to transmit commands to connected Fabric OS switches under the security context of the SANnav management user.

Imprivata EAM <=26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best practices.

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administrator users can write content under targets_modified/ that is later executed by multiple configuration paths below the intended code-execution privilege tier. Table and command or telemetry definitions are processed through ConfigParser, PacketConfig, GENERIC_READ_CONVERSION, or GENERIC_WRITE_CONVERSION, allowing ERB rendering or Ruby and Python evaluation, while openc3-cosmos-script-runner-api/scripts/run_suite_analysis.rb executes suite procedure files through require. Storage uploads, screen saves, and script creation can place content in the overlay, and triggering table processing, a cmd/tlm reload, or suite analysis executes the content in cmd-tlm-api, decom microservices, or Script Runner with access to internal credentials and data. This issue is fixed in version 7.3.0.

In OpenC3 COSMOS from 5.12.0 until 7.3.0, an authenticated actor can write the pypi_url setting through set_setting at POST /openc3-api/api, then cause OpenC3::PluginModel.install_phase2 to interpolate the value into a shell command while installing a plugin with Python dependency metadata. Shell metacharacters in the setting are interpreted by the command shell, allowing arbitrary operating-system commands to run as the openc3 service user with access to Redis and bucket credentials.

In JLine from 3.0.0 until 3.30.15 and 4.3.1, the built-in less viewer passes user-controlled search and display-filter patterns directly to Java's backtracking regular expression engine and repeatedly applies them to file content. A nested-quantifier expression evaluated against non-matching lines can consume excessive CPU and indefinitely block the session thread, and repeated sessions in Telnet or SSH deployments can exhaust a bounded worker pool.

In JLine from 3.0.0 until 3.30.15 and 4.3.1, the built-in grep command accepts a user-controlled regular expression and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions.

The JLine Java console library has a vulnerability in the built-in nano editor where regex search mode passes a user-controlled term to the regex engine without timeout or backtracking bound. A malicious expression can cause excessive CPU usage and block the editor session thread.

The JLine library has a vulnerability in DefaultHistory.matchPatterns where the HISTORY_IGNORE configuration value is converted to a regex with incomplete escaping. An attacker controlling configuration can supply a malicious expression that is reevaluated on each history addition, causing excessive CPU usage and blocking the reader thread.

In OpenC3 COSMOS from 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated in another operator's browser session when the button is activated. The stored script runs in the COSMOS origin and can read localStorage.openc3Token, allowing theft of the victim's bearer token, account takeover, and actions with the victim's privileges.

OpenBao Agent's exec rendering mode could write secrets from env_template to standard output when exec.go re-created the template runner after repeated rendering failures, primarily after num_retries was reached. A process supervisor, log collector, or local user able to read that output could obtain the rendered secret values. This issue is fixed in version 2.6.0.

In CopyAPIView (awx/awx/api/generics.py:873), permission_classes = (IsAuthenticated,) is set, so DRF's get_object() performs no object-level RBAC. The get() handler explicitly guards with request.user.can_access(obj._class_, 'read', obj), but post() does not — it only checks can_access(model, 'add', create_kwargs_check) and can_access(model, 'copy_related', obj). For JobTemplate, can_add and can_copy_related do not imply read permission on the source job template.

In the Formie plugin for Craft CMS prior to 2.2.23 and 3.1.31, the formie/sent-notifications/get-resend-modal-content action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level authorization checks. Any authenticated user able to invoke the action can enumerate notification IDs and read recipient headers and complete HTML email bodies containing submitted form data, even without the sent-notification viewing permission.

In the Formie plugin for Craft CMS prior to 2.2.23 and 3.1.31, the anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a valid submissionEditToken. An unauthenticated attacker can enumerate sequential IDs and overwrite or hijack another user's in-progress multi-page or save-for-later submission, and the modified data can be persisted and forwarded through notifications or integrations when the submission is completed.

In the Formie plugin for Craft CMS prior to 2.2.23 and 3.1.31, the formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a configured integration. An authenticated attacker can replace outbound host properties such as apiUrl while the server uses stored API keys or OAuth tokens, causing non-blind server-side requests to an attacker-controlled or internal host and returning the remote response.

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute arbitrary code as root by injecting pppd options through a crafted VPN username. Attackers can embed a double-quote character or whitespace in the username to break out of the pppd options file quoting context and include the pppd plugin directive, causing the privileged pppd process to load an attacker-controlled shared object.

RunAdHocCommand.build_args() appends limit as a bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags (--version, --help) since the injected element displaces the required pattern positional. Would escalate if ansible-core ever defaults pattern.

LaunchConfigurationBaseSerializer.scm_branch has no validate_scm_branch() leading-dash check, unlike Project/JobTemplate/JobLaunch serializers. Schedule and WFJT Node accept --upload-pack=/bin/id as scm_branch. Currently blocked at runtime by jobs.py:1502 ValueError check (defense-in-depth), but the API validation gap means sole reliance on a task-layer guard. Refactoring that guard away would promote this to RCE.

Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts (job['job'+'_env']) and {% if job.id > 100 %} conditional gating bypass both the AST check and the test-render (stub has small job.id). At runtime, the gated branch executes and exceptions write full tracebacks into the notification body, which is POSTed to an attacker-controlled webhook URL. Leaks install paths, Python version, source line numbers.

The StringListPathField.to_internal_value() method calls os.path.exists() on unbounded user-supplied paths. The 200 vs 400 response difference reveals the existence of arbitrary absolute paths on the controller-web pod, including sensitive files like SECRET_KEY or service account tokens.

The HostList.list() method catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user can trigger Django FieldError (leaking the complete Host model relation graph) or PostgreSQL DataError (leaking raw database error strings).