CVE Vulnerability Catalog

In Sync-in Server prior to version 2.4.0, the failed-TOTP lockout mechanism does not work because the passwordAttempts counter is never incremented. An attacker can brute-force TOTP codes without limit, and upon success obtain a client token exchangeable for a full JWT and permanently disable MFA.

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, POST /api/auth/token authenticates with username and password only, then calls getTokens(), which returns full access and refresh JWTs without checking whether the account has TOTP 2FA enabled. An attacker with stolen or phished credentials can bypass 2FA in a single request. The parallel login endpoint (POST /api/auth/login) correctly enforces 2FA by calling setCookies(user, res, true), which gates on user.twoFaEnabled. Version 2.4.0 patches the issue.

luci-app-advanced-reboot for OpenWrt prior to 1.1.2-6 granted rpcd file.exec permission for the /bin/sh shell under a read ACL. An authenticated delegated session with that ACL could supply caller-controlled parameters, allowing arbitrary commands to execute as root.

luci-app-adblock-fast for OpenWrt prior to 1.2.4-2 allowed the luci.adblock-fast.setCronEntry RPC method to accept an entry argument containing carriage-return or line-feed characters and serialize it into /etc/crontabs/root as one logical line. An authenticated delegated user with the write ACL could create an additional root cron entry, resulting in persistent command execution as UID 0.

In Tautulli prior to version 2.17.2, the unauthenticated /auth/redirect endpoint strips forward slashes from the redirect_uri parameter but leaves tab, line-feed, and carriage-return characters intact. With the default HTTP_ROOT configuration this allows redirecting a user to an attacker-controlled external origin.

Tautulli prior to 2.17.2 in the import_config handler and the database_file branch of import_database joins the attacker-controlled filename directly to CACHE_DIR without basename reduction or a containment check. An administrator or caller with the instance API key can submit a multipart filename containing parent-directory segments, causing the upload to be created or overwritten outside CACHE_DIR.

In Envoy prior to versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1, the HTTP external-authorization client can retain a stale request callback after a request is rejected. Later processing of the authorization response invokes the callback after its owner has been destroyed, causing a use-after-free and process crash.

In Tautulli prior to version 2.17.2, the newsletter cron field is inserted into a JavaScript string without safe JSON encoding. An administrator or a caller with the Tautulli API key can store a crafted cron value that executes script in the Tautulli web context when an administrator opens the newsletter configuration modal.

Dell Command | Monitor (DCM) versions prior to 10.13.2 contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

In Envoy prior to versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1, allocateConnPool dereferences transport_socket_options without first checking whether the pointer is null. With auto_config and HTTP/3 enabled, routine traffic can crash an Envoy worker.

In Tautulli prior to version 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string using manual escaping that does not handle backslashes. A backslash-quote sequence can terminate the string, allowing an unauthenticated attacker to execute script in the Tautulli web context when an authenticated user follows a crafted link.

jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authorization-relation rows without privilege checks. Attackers can manipulate user-role mappings and access controls to escalate privileges, strip access from other accounts, or modify role-function relationships for any user in the tenant.

jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delete other users' business objects by submitting direct object identifiers without authorization checks.

jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and access all business records in the tenant.

jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuration. Attackers can rewrite or delete tenant-wide settings covering company identity, stock rules, approval behavior, and printing configuration through the systemConfig endpoint.

jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user quotas, and enabled state across all platform tenants.

jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission definitions. Attackers can supply arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role in the tenant without privilege validation.

jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticated users to retrieve unsalted MD5 password digests for any user. Attackers can request arbitrary user information by supplying user IDs to obtain password hashes usable for offline cracking or direct authentication bypass.

jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to reset any other user's password. Attackers can submit a request with an arbitrary target user ID to reset that account's password to a known default value.

jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbitrary roles. Attackers can send a POST request with type=UserRole, their own user ID, and a role ID list to escalate from low-privilege tenant user to tenant administrator.