CVE Vulnerability Catalog

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs. Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-guess identifier.

Joomla Extension miniOrange SAML SSO (versions < 11.0.2, < 6.4 for SAML SP Single Sign On) has an authentication bypass vulnerability via the SAMLResponse parameter. The mo_saml_validate_signature() function performs a loose boolean check on the result of openssl_verify(), causing an error return value of -1 to be treated as truthy, allowing unauthenticated attackers to log in as any existing Joomla user, including administrators.

The vulnerability affects ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext, which can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages.

The vulnerability in OpenSSL concerns the verification of password-based protection in the CMP protocol. The library only checks whether the protectionAlg parameter is not NULL, but does not verify its ASN.1 type, leading to dereferencing an invalid pointer. A remote, unauthenticated attacker can exploit this flaw to cause an application crash (Denial of Service).

A vulnerability in OpenSSL's QUIC implementation allows a remote attacker who completes a QUIC handshake to force uncontrolled connection-scoped memory growth. The QUIC stack stores metadata for ACK-only packets even though the protocol does not require them to be acknowledged. Sustained traffic or many concurrent connections can lead to memory exhaustion and denial of service (DoS).

The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them. If a server reuses an OSSL_CMP_CTX frequently, this cache may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth, leading to OOM conditions.

A vulnerability in OpenSSL CMP response validation passes an unexpected response sender distinguished name directly as a format string to ERR_raise_data(). An attacker can craft a sender DN with percent characters, causing a crash of the CMP client. This occurs when the client enforces an expected sender or uses a pinned server certificate.

The vulnerability in OpenSSL affects the CMS_decrypt() function and involves incorrect sizing of the output buffer during key unwrap operations. An attacker can supply a crafted CMS message that causes an 8-byte out-of-bounds heap write, leading to heap corruption and typically resulting in a Denial of Service.

Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit unsanitized ZIP entry names passed to PHP's ZipArchive::extractTo() to write arbitrary PHP files into the web-accessible public directory and achieve remote code execution on the server.

The vulnerability in OpenSSL concerns buffering of DTLS records for a future epoch during a handshake. An attacker can send small forged records, causing an endpoint to retain about 1.7 MB of memory per connection, resulting in a memory amplification factor of about 1200. This can lead to remote memory exhaustion (Denial of Service) on DTLS servers.

Double free of the QRX object in OpenSSL QUIC server stack during failed channel creation for an INITIAL packet. The bug leads to heap corruption and typically results in termination of the QUIC server process (Denial of Service).

In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted "signature_algorithms_cert" TLS extension. The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible.

Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including password changes. An attacker with an admin's profile:read access token can change the admin's password and login to obtain an unrestricted session token that bypasses all scope enforcement.

Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment moderation operations. Attackers with a limited-scope access token can list, approve, reject, delete comments, and modify comment system settings by directly accessing the unprotected panel endpoints.

Ech0 before version 4.4.3 contains a server-side request forgery vulnerability in the validateWebhookURL function (webhook_setting_service.go), which only validates literal IP addresses via net.ParseIP() and fails to reject hostnames that DNS-resolve to private or internal IPs (e.g., 169.254.169.254.nip.io). An attacker with admin privileges can create a webhook with such a hostname to bypass validation and cause the server to make requests to internal services, cloud metadata endpoints, and private network resources. The issue is fixed in 4.4.3.

Ech0 before 4.4.3 contains a stored cross-site scripting vulnerability in the file upload endpoint that validates Content-Type using only client-supplied headers without server-side inspection. Attackers with admin privileges can upload SVG or HTML files containing JavaScript that executes in the application origin when accessed by any user, enabling session hijacking and data exfiltration.

Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather reconnaissance data including internal file paths, error stack traces, and application state.

Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement metrics without identity verification or rate limiting. Attackers can send repeated requests to arbitrarily inflate the fav_count field for any known echo identifier, compromising the integrity of engagement metrics and social ranking systems.

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token (least-privilege) restrictions on several privileged admin routes. Multiple privileged endpoints (e.g., /api/inbox, /api/panel/comments, /api/backup/export) omit scope checks and authorize based only on the user's admin role, and the backup export handler discards token scope metadata entirely. An attacker holding a deliberately limited (low-scope) admin access token can reach broader privileged functionality than intended, including reading the inbox and exporting a full database backup ZIP archive. Fixed in 4.4.3.

Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data including file paths, stack traces, and internal URLs.