CVE Vulnerability Catalog

IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the New Query Builder REST Processor. A low-privileged authenticated user can inject SQL statements through the newQueryBuilder REST endpoint, potentially resulting in unauthorized access to data.

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL statements through the Load Balancer Servlet endpoint, potentially resulting in unauthorized access to data.

IBM Guardium Data Protection 12.2 could allow an authenticated user to execute arbitrary commands with low user privileges on the system due to improper validation of user supplied input.

IBM Guardium Data Protection 12.2 is vulnerable to an authenticated OS command injection vulnerability in the exportCertificate functionality. Successful exploitation could allow an attacker to execute unauthorized commands and impact the confidentiality, integrity, and availability of the affected system.

IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability in the generateInsertQuery functionality of change-tracker-data.sql. A remote attacker could inject malicious SQL that is subsequently processed by the application, potentially resulting in compromise of the confidentiality, integrity, and availability of the affected system.

Autobahn Python prior to 26.7.1 contains a vulnerability in WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize, where the limit is enforced on the compressed frame length before inflation but not rechecked after decompression. A remote unauthenticated client can send a valid compressed frame below the wire-size limit that expands beyond the application message limit, causing oversized data to be allocated and processed, potentially leading to resource exhaustion.

CordysCRM prior to 1.7.4 contains a vulnerability in the /attachment/preview/{id} and /pic/preview/{id} routes, which are configured as anonymous and call AttachmentService.getResource without ownership, organization, or permission checks. An unauthenticated attacker who guesses or observes an id generated by IDGenerator.nextStr can download files uploaded by users in other organizations.

CordysCRM prior to 1.7.4 contains a vulnerability in the GET /pool/lead/get/{id} and GET /pool/account/get/{id} routes, which use bare pool-read permission checks without the CsPermission resourceId binding that enforces per-record data scope. An authenticated user with the ordinary CLUE_MANAGEMENT_POOL:READ or CUSTOMER_MANAGEMENT_POOL:READ permission can supply another record's id and cause unscoped primary-key getters to return leads or accounts owned by other users, departments, or organizations. Exposed data includes contact names, phone numbers, owner and department attribution, and custom field values.

CordysCRM version 1.7.3 contains an SSRF vulnerability in ApprovalResourceService.sendWebHook, which reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it to HttpClientUtils without the SSRF validation. A user with PROCESS_SETTING_ADD can configure an internal URL through POST /approval-flow/add, and the server will request it when POST /approval-action/approve executes, enabling cloud metadata access, internal network reconnaissance, and interaction with reachable internal services.

CordysCRM versions 1.7.0 through 1.7.4 contain a SQL injection vulnerability in the POST /account-pool/page endpoint. An authenticated caller with MODULE_SETTING_UPDATE can place an arbitrary database function in SortRequest.name because Spring request validation is missing and the blacklist is incomplete. Functions such as extractvalue and updatexml can expose database values through an error oracle.

In libsmpp35 from 0.1.0 through 1.8.0, an out-of-bounds read issue was found in the smpp34_unpack() function via attacker-controlled SMPP PDUs, leading to memory corruption.

IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header.

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilters permits the SSE paths, and the endpoints trust the caller-controlled userId instead of deriving an identity from an authenticated principal. An unauthenticated caller can use /sse/subscribe to read another user's workflow events, approval requests, mentions, and alerts, use /sse/broadcast to inject SYSTEM_HEARTBEAT messages into another user's stream, or use /sse/close to terminate another user's channel. This vulnerability is fixed in 1.7.2.

CordysCRM prior to version 1.7.2 allows unauthenticated access to the GET /mcp/form/config/{formKey} endpoint due to ShiroFilter marking /mcp/** as anonymous and missing permission annotations. An unauthenticated caller can obtain field names, types, validation rules, and binding sources for CRM modules, enabling reconstruction of the application data model.

pg_partman prior to version 5.5.0 has a vulnerability in run_maintenance() where exceptions are handled outside the loop processing rows from part_config. An exception for one partition set immediately terminates the loop and skips later sets. A role with partman_user access can insert or update a row that reliably fails and assign it a low maintenance_order value to be processed before legitimate rows.

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, drop_partition_id() and drop_partition_time() use part_config.retention_schema as the target for ALTER TABLE SET SCHEMA and accept any nonempty schema name. A role with partman_user access can select a target schema where the role lacks the normal CREATE privilege, and the background worker performs the relocation with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, bypassing the authorization check.

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherit_template_properties() manually surrounds primary-key column names from pg_attribute.attname with double quotes without escaping embedded double-quote characters. A partman_user who owns a template table can create a crafted column name that breaks out of the generated ALTER TABLE ADD PRIMARY KEY identifier when the background worker applies the key to a child partition.

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, when pg_jobmon is installed and part_config.jobmon is true, exception handlers in multiple pg_partman functions place p_parent_table verbatim inside a SQL string literal used to call pg_jobmon.add_job(). A partman_user can create a parent-table name containing a single quote that terminates the literal and injects SQL when an affected exception path runs.

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undo_partition() reads part_config.time_encoder as unrestricted text and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with partman_user access can store SQL rather than a function name, and the SQL executes with the privileges of the caller that invokes undo_partition().