CVE Vulnerability Catalog

A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the file backend/src/main/java/org/booklore/controller/AppSettingController.java of the component Settings API Endpoint. Such manipulation leads to incorrect authorization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 2b66ca6df8110f6b512e030b54c16b9fbe318f17. Applying a patch is advised to resolve this issue.

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent requests that share the connection. Mint.HTTP1.Parse.chunk_size/1 stops at the first non-hexadecimal byte of a chunked response's chunk-size line and returns the remainder unexamined, and Mint.HTTP1.decode_body/5 discards bytes up to the CRLF, so lines such as 5ZZZZZ and 5 9 are accepted as chunk size 5, and 0ZZZZ as the terminating chunk. This issue affects mint from 0.1.0 before 1.10.1.

Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass. Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from resetting passwords, to delete a user's password credentials, resulting in the user being unable to log in.

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated administrator with limited permissions to add themselves to a high-privilege group, potentially gaining full control over the entire realm.

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client is still enabled before issuing a new access token. This allows an application with an existing refresh token to continue obtaining valid access tokens for a disabled client, potentially bypassing administrative access controls for resource servers that rely on offline JWT validation.

rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin. newVolume() in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Join(drv.root, name) from the attacker-supplied `name` field of a Docker VolumeDriver.Create request without verifying that the result stays within drv.root (default /var/lib/docker-volumes/rclone), and checkMountpoint() then creates that directory with file.MkdirAll before mounting. A volume name containing enough `..` components (e.g. "../../../../../../etc") therefore resolves outside the base directory, allowing anyone able to submit a VolumeDriver.Create request to the plugin socket to make the privileged rclone plugin process create a directory and mount a remote filesystem at an arbitrary host path. Volume.restoreState() had the same missing validation when reloading persisted volume state. Fixed in 1.75.1.

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the destination root, though downstream protections in the local backend currently block actual file escape.

OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.

OpenPanel API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.

OpenPanel through 2.3.0 fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from other projects.

OpenPanel through 2.3.0 writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests and access project analytics.

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream(). These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.

DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. These attributes are passed to require without checking that the value names a module, allowing loading and executing code from any file.

The Partial Shipment for Woocommerce plugin for WordPress in versions up to and including 3.4 is vulnerable to Missing Authorization via the 'wxp_order_shipment', 'wxp_order_item_shipment', and 'wxp_order_set_shipped' AJAX actions. Lack of capability checks, nonce verification, and order ownership validation allows authenticated attackers with Subscriber-level access and above to read arbitrary order item details and modify shipment status of any order.

The Empik for Woocommerce plugin for WordPress in all versions up to and including 1.5.1 is vulnerable to authorization bypass. The plugin does not properly verify that a user is authorized to perform an action, allowing authenticated attackers with subscriber-level access and above to modify arbitrary WooCommerce product metadata, including Empik logistic class, product state, and export/offer flags.

The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress in all versions up to and including 2.6.65 is vulnerable to authorization bypass. The plugin does not properly verify that a user is authorized to perform an action, allowing authenticated attackers with subscriber-level access and above to create and cancel real shipping orders via the external logistics API, modify arbitrary WooCommerce order post meta, overwrite the plugin's stored API token, and trigger shipping notification emails.

The WordLift – AI powered SEO – Schema plugin for WordPress in all versions up to and including 3.54.10 is vulnerable to Sensitive Information Exposure via the JSON-LD REST API endpoints. The /wordlift/v1/jsonld/ routes are registered with a permission_callback of '__return_true', and the converter retrieves posts via get_post() without verifying post status or user capabilities, allowing unauthenticated attackers to read metadata of private, draft, and pending posts.

A vulnerability has been identified in the Totolink A3002MU router (version Hh-B20211125.1046) in the formWsc function of the /boafrm/formWsc file. Manipulation of the localPin argument leads to command injection. The attack can be launched remotely, and a public exploit is already available.

The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pop_tag' parameter in all versions up to and including 1.3.15 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.