CVE Vulnerability Catalog

A time-to-check-time-of-use vulnerability in the polkit authentication of qSnapper before version 1.3.3 allowed a local attacker to bypass qSnapper's authentication mechanism and operate with root privileges.

IBM WebSphere Application Server versions 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications.

A vulnerability in the Geomap panel in Grafana allows a user with Editor permissions to inject a malicious script into the attribution field of an XYZ tile layer via a template variable. The script executes in the browser of any user viewing the affected dashboard (stored cross-site scripting).

A path traversal vulnerability exists in AIL Framework before the release containing commit 0041456af25da0cdea1c1c4624e46baff2731d8f. An authenticated AIL user can supply crafted object identifiers through the investigation workflow to access files outside the intended directories.

MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbitrary filesystem path, potentially leading to arbitrary code execution with the privileges of the MISP process.

MISP allows a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Due to the ability to inject PHP code by an attacker with administrator privileges, remote code execution may occur.

The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorization flow that could allow attackers to bypass important security guarantees provided by the protocol. The vulnerability includes session identifier leakage, lack of session rotation after login, weak OAuth state, missing HTTPS enforcement, and log injection.

The MISP core contains multiple access control flaws that allow unauthorized modifications and deletions of data across organizations. Lower-privileged users can manipulate objects they are not authorized to edit.

MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. Users with broad permissions could delete objects belonging to other organizations without proper authorization.

The Windows Machine Config Operator (WMCO) for Red Hat OpenShift establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker can intercept or redirect the SSH session to capture WICD and kubelet bootstrap credentials.

A flaw in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform allows the WICD CSR auto-approver to validate the presence of the 'system:wicd-nodes' organization but not reject additional organizations like 'system:masters'. A compromised Windows worker node with WICD credentials can obtain a client certificate with cluster-admin privileges, leading to full cluster takeover.

A vulnerability in the Loki data source plugin allows a user with Viewer permissions to exploit a path traversal to reach administrative Loki endpoints. This enables reading sensitive backend configuration and internal service information.

In ArubaSign, versions prior to v4.6.6 have incorrect default permissions that grant excessive permissions to the 'Everyone' group for the main executable and other program files. This could allow an unprivileged user to replace the main executable with a malicious file.

A vulnerability in GitHub Copilot 1.372.0 allows filesystem access outside the workspace folder without user approval via a file-handler URI parameter in fetch_webpage. This could lead to data exfiltration if combined with indirect prompt injection.

EasyFlow .NET developed by Digiwin has a Session Fixation vulnerability. Unauthenticated remote attackers can replace a specific session ID for a user, allowing them to gain the user's privileges once the user logs in.

SafeLine SL6 and SL6+ devices integrated into elevator emergency intercom systems are vulnerable to an authentication bypass. This vulnerability allows attackers to bypass authentication requirements and access the device's configuration service via the Bluetooth Low Energy (BLE) interface.

A stored cross-site scripting vulnerability in the Runtime component of Pilz PASvisu before version 1.14.1 and PMI v8xx up to and including version 2.0.33992 allows a low-privileged remote unauthenticated attacker to manipulate process data, potentially impacting integrity and/or availability.

A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before version 1.14.1 allows a local unauthenticated attacker to inject malicious JavaScript and gain full control over the device.

Apache NiFi versions 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include components marked as Restricted. This lack of authorization allows users with general write access to add components with restricted access.

Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi versions 1.2.0 through 2.9.0 allows for injecting SQL commands using crafted naming. Manual quoted boundaries added in Apache NiFi 1.8.0 narrowed the scope of potential injection options, but did not cover additional strategies.