CVE Vulnerability Catalog

Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access reports that no migrations are available and does not cause data loss, alter application state, reveal confidential information, or produce a documented availability impact. This issue is fixed in version 16.0.

Anyquery prior to 0.4.5 allows authenticated users with INSERT or UPDATE access to macOS virtual tables to execute operating-system commands. The Chrome, Brave, Edge, and Safari plugins interpolate a SQL-controlled URL into AppleScript or JXA source passed to osascript.

A stack-based buffer overflow vulnerability has been discovered in MCC Universal Library for Linux (uldaq). This may result in information disclosure or arbitrary code execution. The vulnerability affects uldaq v1.2.1 and prior versions.

A vulnerability was found in SourceCodester Drug Recommendation System 1.0 affecting some unknown processing of the file /db/drug_recommendor.sql, resulting in information disclosure. The attack can be carried out remotely, and the exploit has been made public and could be used.

A vulnerability has been found in code-projects Matrimonial System 1.0. It affects the writepartnerprefs function in /partner_preference.php, where manipulation of the education argument leads to SQL injection. The attack can be executed remotely and the exploit has been publicly disclosed.

Verizon Cloud for Android (com.vcast.mediamanager) before 26.7.10 contains a path traversal vulnerability that allows co-resident malicious applications to write attacker-controlled bytes outside the intended staging directory by supplying a crafted _display_name value containing path-traversal sequences through exported activities OneTouchUploadActivity and PrintShopCloudActivity. Attackers can exploit the unsanitized filename concatenation in the file-staging sink via ACTION_SEND or ACTION_SEND_MULTIPLE intents to achieve arbitrary file write and inject attacker-controlled content into the authenticated user's Verizon Cloud account without user interaction.

Scoold is a Q&A and knowledge sharing platform for teams. Prior to 1.69.0, authenticated users who are not members of a private space can create content in questions belonging to that space because QuestionController.reply() and CommentController.createAjax() do not apply the canAccessSpace authorization check used by the question read path. With scoold.is_default_space_public set to false and private spaces in use, a user with a valid session and a known or enumerable question identifier can send requests to POST /question/{id} and POST /comment, causing replies and comments to be stored in a thread the user cannot read.

Scoold is a Q&A and knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot access because ApiController.getPostReplies() does not apply canAccessSpace before returning data from GET /api/posts/{id}/answers. The issue is reachable when scoold.api_user_access_enabled and scoold.api_enabled are true and a token holder knows or enumerates a private question identifier. Under those conditions, the question endpoint can deny access while the answers endpoint returns the private reply bodies.

WireGuard Portal (wg-portal) is a web-based configuration portal for WireGuard server management. From 2.2.0 until 2.3.0, the authenticated GET /api/v0/ws statistics WebSocket subscribes to TopicPeerStatsUpdated and TopicInterfaceStatsUpdated and forwards every TrafficDelta event without per-user authorization in handleWebsocket(). A low-privilege user can enumerate peer public keys through EntityId and monitor BytesReceived and BytesTransmitted values for peers belonging to other users. The same connection exposes interface_stats and interface names that the REST API limits to administrators.

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to 13.22.1, the authenticated PUT /api/basemap endpoint passes an attacker-controlled URL through importBasemapURL() to fetch(url) without resolved-address classification or redirect revalidation. BasemapProtocol.isValidURL checks only the HTTP or HTTPS scheme and is not applied on the vulnerable import path. Direct internal addresses, alternate IP encodings, and redirects to internal addresses can reach cloud metadata, loopback, private, and CGNAT HTTP services. The OptionalTileJSON response reflects fields including name, attribution, and tiles[0] to the caller, making the request forgery full-read rather than blind and enabling cloud credential theft and internal service disclosure.

In NetLicensing MCP Server prior to 0.1.6, HTTP requests to /mcp that omit API key credentials pass through ApiKeyMiddleware without authentication. The downstream context then falls back to the operator's API key, allowing an unauthenticated attacker to invoke MCP tools and perform operations on licensing objects, including destructive deletes.

Many Notes prior to 0.16.0 allows an authenticated user to write arbitrary files outside their own vault during ZIP vault import. Through parent-directory traversal segments in filenames, an attacker can overwrite other users' files and place malicious SVG content leading to stored XSS.

In OpenDDS prior to 3.34.0, a network attacker can send a malformed RTPS UDP submessage that causes the read pointer to advance beyond valid data. This results in a SIGSEGV in the receive thread and termination of the DDS process. No authentication or user interaction is required.

In rabbitmq-c prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.frame_max value, leading to a heap buffer overflow and memory corruption. This can cause denial of service and theoretically code execution.

rabbitmq-c before version 0.16.0 contains an unsigned size_t underflow in amqp_handle_input() in librabbitmq/amqp_connection.c. A malicious AMQP server can send an undersized HEADER or METHOD frame during client login, leading to an out-of-bounds read and process crash. The issue also occurs when AMQP traffic is not protected by TLS with certificate validation.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

MISP contains a stored cross-site scripting (XSS) vulnerability in the Overmind theme's statistics views. The event General card and the server/feed preview card constructed donut chart legend labels by directly concatenating object name or category keys into an innerHTML string without HTML-encoding. Because MISP object names are user-controllable by any authenticated user with sufficient permissions, an attacker could craft a name containing malicious markup. When any other user viewed the affected Overmind dashboard, the injected markup would be interpreted as live HTML/JavaScript in the victim's browser.

MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. The events/contact endpoint passes user-controlled fields (message and person) into job arguments without validation. An attacker can set the person field to a reserved switch and the message field to a phar:// URI pointing to a malicious archive, leading to PHP code execution.

SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into ClickHouse string literals without escaping. An authenticated attacker can inject SQL through funnel step definitions to execute arbitrary queries and read results in HTTP responses.

In the Linux kernel, the batman-adv module's dat handling updated MAC addresses using a simple copy, which could be partially observed by parallel readers. A reader might transport a half-updated MAC address over the network or use it in ARP responses, poisoning the ARP cache. The fix uses atomic64_t to store the 48-bit MAC address, ensuring readers see either the old or new address, never a mixture.