CVE Vulnerability Catalog

In Snipe-IT prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.delete can directly POST to /users/bulksave with delete_user=1 because BulkUsersController::destroy() authorizes only update, allowing the user to soft-delete another non-admin user.

In Snipe-IT prior to version 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model, including the company_id field. This allows a low-privileged authenticated user from one company to create accessory records under another company when Full Multiple Companies Support is enabled.

A vulnerability in Coturn prior to version 4.13.0 allows an authenticated TURN client to bypass the default loopback peer rejection by using an IPv4-mapped IPv6 address (::ffff:127.0.0.1) in the XOR-PEER-ADDRESS attribute. The loopback check does not properly handle this address type, enabling relay traffic to localhost services on the Coturn host.

A vulnerability in Coturn prior to version 4.12.0 allows SQL injection through the HTTPS admin panel. HTTP query parameters are passed directly into SQL queries without sanitization, enabling an authenticated admin to inject arbitrary SQL.

HestiaCP before version 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in is_dns_record_format_valid() combined with unsafe eval-based parsing in update_dns_zone() to prematurely close a variable assignment string and achieve full root code execution on the underlying host in a single DNS record creation step.

A vulnerability in ZITADEL prior to version 4.15.3 allows a low-privilege token to be exchanged for elevated permissions in another application. This occurs because the OAuth2 Token Exchange endpoint does not verify that the subject token belongs to the requesting client or that requested scopes remain within the original token's scopes.

In ZITADEL prior to version 4.15.3, the Login V2 OIDC and SAML FailedPrecondition error paths pass loginSettings.defaultRedirectUri to router.push without applying the isSafeRedirectUri check. This allows an organization or instance administrator to store a javascript or data URI that can execute in a user's browser when an affected login error path is reached.

In ZITADEL prior to versions 3.4.12 and 4.15.2, OAuth2 and OIDC flows (CodeExchange, RefreshToken, device token) fail to verify that the requesting client matches the client that initiated the authorization flow, allowing intercepted grants or refresh tokens to be exchanged under a different client.

The grav-plugin-admin plugin in version 1.10.52 and earlier allows an authenticated attacker with admin.users permission to change the password of any user account, including the super administrator. The vulnerability exists because the saveUser function only checks general user-management permissions but does not verify whether the caller is authorized to edit the target user.

The Excelize Go library before version 2.11.0 has a vulnerability due to missing lower-bound validation when parsing shared-string cell values. A specially crafted XLSX file with a value of -1 can cause an out-of-bounds slice access and panic when read via GetCellValue or GetRows.

The Excelize Go library before version 2.11.0 does not enforce the TotalRows limit on the row r attribute during streaming worksheet reading. An attacker can supply a small XLSX file with a row number above 1048576, causing empty rows to be appended and excessive memory and CPU consumption.

9Router before version 0.5.2 treats loopback requests as trusted and allows /v1/* access without an API key. A same-host reverse proxy forwarding public traffic through 127.0.0.1 causes src/dashboardGuard.js to misclassify external requests as local, enabling a remote unauthenticated attacker to access /v1 APIs such as /v1/models and potentially abuse configured upstream provider credentials through /v1 proxy endpoints.

A vulnerability in the Espressif IoT Development Framework (ESP-IDF) allows an out-of-bounds write on the stack when parsing the DQT marker in JPEG files. An attacker can supply a crafted JPEG image, leading to a denial of service.

9Router prior to version 0.5.2 has a vulnerability where it determines whether a /v1 LLM proxy request is local by reading the client-controlled Host header, allowing a remote unauthenticated attacker to send Host: localhost and bypass API-key authentication.

9Router before version 0.5.2 fails to protect the /codex path, allowing a remote unauthenticated attacker to bypass the API-key gate and send requests to /codex/*, which are rewritten to /api/v1/responses. The attacker can exploit this to make upstream provider calls using operator-stored LLM credentials.

The cpp-httplib library versions 0.31.0 through 0.46.1 (Mbed TLS backend) and 0.33.0 through 0.46.1 (wolfSSL backend) skip certificate chain validation when connecting to an IP-literal host in HTTPS mode. This allows a man-in-the-middle attacker to present a crafted certificate and intercept or modify traffic.

The Excelize Go library before version 2.11.0 has a vulnerability in the checkSheet() function that uses an attacker-controlled XML attribute <row r="N"> without validation. A crafted XLSX file can cause massive memory allocation (up to 16 GB) or a panic due to out-of-bounds indexing, leading to denial of service (DoS).

In Lima prior to version 2.1.3, when using the qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock with the guest agent enabled. This allowed executing arbitrary commands with root privileges in the VM because the guest agent socket provides tunneling for arbitrary addresses, including Unix socket addresses for privileged daemons like D-Bus.

Grav, a file-based web platform, contains a vulnerability allowing an unauthenticated attacker to exhaust server memory and CPU by requesting oversized image derivatives. The issue is in the `Grav::fallbackUrl` mechanism, which passes request parameters to ImageMedium magic actions without dimension or pixel limits.

In Simple Machines Forum 2.1 prior to commit 7d048f8 and 3.0 prior to commit a7875e8, there is an authorization bypass vulnerability in Sources/Actions/AttachmentApprove.php. A single-character operator error causes the permission check to always pass regardless of user permissions.