CVE Vulnerability Catalog

MISP contains a stored cross-site scripting (XSS) vulnerability in the default theme's Galaxies index page. Sample tag names from unknown galaxy clusters are inserted into HTML without entity encoding, allowing a user with tag-editor privileges to inject malicious script. A site administrator viewing the Galaxies page executes that script in their browser session.

A vulnerability was found in ST Engineering iDirect iDX and Evo iDX, affecting the /authorize file of the HTTP Request Handler component. Manipulation of the Success argument leads to HTTP response splitting, exploitable remotely, and the exploit has been publicly disclosed. This vulnerability only affects products no longer supported by the maintainer; current supported releases (X10, X11, Velocity 5.x+) have no validated evidence of impact.

A vulnerability was found in ST Engineering iDirect iDX and Evo iDX, affecting the Location Header Handler component. Manipulation of the Host argument results in an open redirect, exploitable remotely, and the exploit has been made public. This vulnerability only affects products no longer supported by the maintainer.

A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/Dashboard/Templates/show.blade.php of the component Project Dashboard. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. "EDIT perm" needed to plant; fires cross-user for anyone viewing the project dashboard since the poisoned label name is echoed raw. The vendor was contacted early about this disclosure but did not respond in any way.

An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 could allow an attacker to execute arbitrary commands on the server.

A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway, when processing S3 presigned URLs using Signature Version 4 (SigV4). The service fails to reject requests containing unsigned x-amz- headers, instead dropping them from the signature calculation. This allows an attacker with a valid presigned PUT URL to add an unsigned x-amz-copy-source header, converting a simple upload into a CopyObject operation.

A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Tickets.php of the component Kanban Board. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: a30a6837b4071ac05a4f58d0e1baa2c62aa8695e. To fix this issue, it is recommended to deploy a patch.

When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service).

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Temporal Server vulnerability allows an authenticated user with write access to a single namespace to execute arbitrary commands on the host running the Worker Service. The command is executed immediately, and since the Worker Service process holds credentials and TLS material for the entire cluster, the impact escalates to full cluster compromise. Affected versions are 1.31.0 through 1.31.2 (before 1.31.3), and the issue is present in default binaries and container images.

Temporal Server in releases 1.30.0 and later decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller with write permission in a single namespace could attach a callback whose 'source' header caused the request to be re-targeted at the internal frontend and executed as a system administrator against the administrative API. Releases 1.25.0 through 1.29.7 are affected by a narrower form of the same defect requiring the header to match a configured cluster ID.

github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply those limits to label maps received in SWIM membership changes. A network peer that can reach a live Ringpop TChannel listener can repeatedly submit changes for distinct member addresses containing label keys, values, or counts that exceed the receiver's configured limits. Accepted labels are retained in the member list and disseminated to peers, allowing memory and gossip-bandwidth consumption to exceed configured bounds and potentially making the hosting process unavailable.

github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragment, including as a direct initial call request after completing the standard initialization handshake, causing an unrecovered Go slice-bounds panic on a library-created dispatch goroutine and terminating the hosting process.

github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener can complete the standard initialization handshake and send a call request with an unsupported checksum type. The parser uses that value as an index into a four-entry checksum pool, causing an unrecovered Go panic on the connection read goroutine and terminating the hosting process.

The temporalio/sqlparser library accepts SQL containing deeply nested unary expressions and returns a correspondingly deep abstract syntax tree without enforcing a nesting limit. Its String and Walk operations recursively traverse that tree, which can cause a runtime-fatal Go stack overflow that terminates the process. Temporal Server passes caller-controlled query input through the affected parser in archival, visibility, and worker-query paths.

Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule combining a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing excessive CPU consumption in Frontend and Schedule worker components.

The temporalio/sqlparser library can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary, causing a Go runtime panic that terminates the process.