CVE Vulnerability Catalog

A weakness has been identified in ColorFul iGameCenter 1.0.3.4, affecting the function sub_140001AF0 in the ene.sys library of the IOCTL Handler component. This manipulation causes an untrusted pointer dereference. The attack can only be executed locally, and the exploit has been made publicly available.

In Warpgate prior to version 0.28.4, the PUT /@warpgate/admin/api/users/:id/roles/:role_id endpoint does not require AdminPermission::AccessRolesAssign. A limited administrator with any permission can update expires_at on an existing UserRoleAssignment and clear revoked_at, extending an expiring grant or reinstating a revoked grant.

Warpgate up to version 0.27.6 has a vulnerability in the browser SSH path where the jump host key is stored for the target address. In Prompt and AutoAccept modes, a machine presenting the jump host key at the target address can be accepted as the target, allowing interception of user traffic and a newly issued certificate when certificate authentication is used. The native SSH path is unaffected because it tracks each hop separately. This issue is fixed in version 0.27.6.

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the response_mode=form_post SSO return path in warpgate-protocol-http/src/api/sso_provider_list.rs uses serde_json::to_string inside ReturnToSsoPostResponse without neutralizing a script-closing sequence. The vulnerable value can enter the script block through the attacker-controlled next redirect parameter stored by warpgate-protocol-http/src/api/sso_provider_detail.rs or through IdP-derived error messages that make_redirect_url concatenates without URL encoding. The IdP-derived path is reachable when the attacker controls a configured identity provider, or when the attacker controls the email or username claim on an attacker-controlled account and the configured identity provider permits the required unvalidated claim format. A victim must complete the form_post SSO flow for the injected markup to be rendered. The Warpgate Content-Security-Policy blocks injected JavaScript and event handlers, so the demonstrated impact is content spoofing, a false login form, or a meta refresh rather than script execution. This issue is fixed in version 0.27.6.

Warpgate up to version 0.27.3 has a vulnerability in HTTP API token authentication where token validation does not enforce the owning user's allowed_ip_ranges against the trusted client address. An attacker holding a leaked, phished, or exfiltrated X-Warpgate-Token can use it from a prohibited network location. Deployments without allowed_ip_ranges are unaffected, and other paths (HTTP target proxying, SSH, MySQL, PostgreSQL, RDP, VNC, Kubernetes) do not accept this vulnerable HTTP token flow. This issue is fixed in version 0.27.3.

Dell Command | Integration Suite for System Center versions prior to 6.7.2 contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.

Dell Command | Intel vPro Out of Band versions prior to 4.7.2 contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical details about the vulnerability are available.

Warpgate, an open source SSH, HTTPS and MySQL bastion host for Linux, prior to 0.25.6 has a vulnerability in api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs. The endpoint /@warpgate/admin/api/recordings/{uuid}/stream is protected only by session authentication, omitting require_admin_permission for AdminPermission::RecordingsView. Any authenticated regular user who identifies an active recording can subscribe to its WebSocket and receive real-time terminal input and output from proxied SSH, MySQL, or PostgreSQL sessions, including credentials and commands.

Warpgate prior to version 0.25.6 has a vulnerability in the HTTP proxy where a client-supplied x-warpgate-username header is forwarded before the authenticated username is appended. Because the request builder preserves repeated values, a proxied backend that trusts the first value can authorize an authenticated attacker as another user. The same forwarding policy also accepts the reserved x-warpgate-authentication-type header. This issue is fixed in version 0.25.6.

InvenTree prior to version 1.4.0 has a vulnerability in WeasyPrint report rendering where privileged users can cause retrieval of attacker-selected resources via HTTP, HTTPS, or local file URI schemes. The lack of a restricted url_fetcher allows reading local files or internal HTTP responses, enabling full-read SSRF, arbitrary local file disclosure including application credentials, and possible compromise of a superuser account. This issue is fixed in version 1.4.0.

InvenTree prior to version 1.4.0 has a vulnerability in the /api/report/print/ and /api/report/label/print/ endpoints, which require authentication but do not check per-model view permissions before selecting objects and rendering them with a chosen template. A role-less or unrelated-role account can enumerate object identifiers and download reports containing purchase, sales, part, BOM, stock, build, supplier, customer, pricing, and inventory data that the corresponding detail APIs would deny. This issue is fixed in version 1.4.0.

InvenTree prior to version 1.4.0 has a vulnerability in the /api/importer/row/ and /api/importer/mapping/ endpoints, which do not scope querysets to the owner of the associated import session. Any authenticated user, including an account with no assigned roles, can supply another user's import session identifier and retrieve that session's row_data and data fields together with its column mappings. This exposes the full contents of data staged for import across users. This issue is fixed in version 1.4.0.

InvenTree prior to version 1.4.0 has a vulnerability in plugin settings endpoints, which lack the IsAuthenticated permission. An unauthenticated caller can retrieve plugin names, setting keys, descriptions, types, choices, and non-protected configuration values. Protected secret values remain masked, limiting the issue to metadata and non-secret configuration disclosure. This issue is fixed in version 1.4.0.

InvenTree prior to version 1.4.0 has a vulnerability in the /api/barcode/ endpoint, which accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key. The endpoint requires only authentication or a general read scope, and the built-in barcode plugin returns the complete model serializer output without checking the caller's per-model view role. A low-privilege user can enumerate primary keys for parts, stock, locations, supplier and manufacturer parts, orders, and builds to disclose commercially sensitive data. This issue is fixed in version 1.4.0.

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso/return handler inserts without HTML escaping into the response generated by warpgate-protocol-http/src/api/sso_provider_list.rs. A victim who follows a crafted link and completes SSO can cause markup and JavaScript to execute in the authenticated Warpgate origin, allowing access to session data and actions through user APIs, and through administrator APIs only when the victim is an administrator. The GET /@warpgate/api/sso/return path also uses the same unvalidated value as a redirect destination, enabling an open redirect.

Dell Command Powershell Provider (DCPP), versions prior to 2.10.2, contain an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.

The Time-aware GPIO driver in Zephyr OS lacks validation of output pointers in the tgpio_pin_read_ts_ec() syscall, allowing an unprivileged thread to write to arbitrary kernel memory. The vulnerability only affects builds with CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y, and practical exposure is limited by build issues in some versions.

Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. This occurs in button.text.toUtf8 in export_output_html.cpp. Exploitation cannot occur unless HTML export was used by a victim, but the exploit payload can be exported if a message were forwarded into a group by a member.

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows when sending a message whose envelope address reaches the shell in _sendmail_pipe. On MSWin32 the envelope sender and every recipient are combined into a single command string passed to a shell via open(). An attacker controlling one of those header addresses can run commands as the sending process.