CVE Vulnerability Catalog

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file-based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause files outside the configured squirrelmail_data_dir to be read and imported.

A security vulnerability was detected in massCodeIO massCode 5.10 in an unknown function of the file src/main/api/index.ts of the Local HTTP Service component. Manipulation leads to information disclosure, and the attack can be launched remotely. The exploit has been publicly disclosed and may be used; the patch is named d25d8fa3f5a1e34285c8634f18729650c0c05cda.

GitLab EE in versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 contains an issue that under certain conditions could allow an authenticated user to access paid AI features without a valid subscription due to insufficient server-side validation in billing eligibility checks.

GitLab CE/EE versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 could, under certain conditions, allow an unauthenticated user to retrieve sensitive internal server credentials due to improper filtering of internal response headers.

A hardcoded cryptographic key management vulnerability exists in Archer C6 due to the use of a universal cryptographic key shared across devices. An attacker who obtains an encrypted configuration file or other protected credential data can recover plaintext credentials.

In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted credential data can submit Basic authentication data to the REST API to expose and decrypt that data. The vulnerability exists because Splunk SOAR decrypts encrypted Basic authentication values before completing authentication checks. The attack requires the user to possess encrypted credential data from an affected instance.

In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edition through the REST API, causing Splunk SOAR to apply the license change. The vulnerability exists because Splunk SOAR authenticates requests to manage the Enterprise Security edition but does not authorize the caller before applying the license change.

In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view apps could download an archive of an installed app. This could expose all data in the app archive, including proprietary source code and sensitive information. The vulnerability is possible because Splunk SOAR does not verify permission to view apps before it returns the app archive.

In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to edit Automation Brokers could download the Splunk SOAR Automation Broker Docker Compose configuration file. The file contains the URL of the Splunk SOAR instance, the container image location, and the Splunk SOAR Automation Broker version. The vulnerability is possible because Splunk SOAR returns the configuration file without enforcing the Automation Broker edit permission.

In Splunk SOAR versions below 8.7.0, a user with a role holding the install_apps capability can install an app containing attacker-controlled content in its documentation, which Splunk SOAR does not sanitize before display. When another user with permission to view apps opens the app documentation, that content is executed in their browser, potentially allowing the attacker to access data and make changes with the victim's privileges.

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could trick a user holding the edit_federated_providers capability into turning off all federated search providers. This is possible because the federated provider REST API accepts GET requests for state-changing actions, and exploitation requires phishing the affected user.

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move, edit, or delete sourcetype renaming configurations that they own in apps that they do not have permission to access. The vulnerability is possible when Splunk Web is turned on because Splunk Web does not verify the required app permissions before it performs sourcetype renaming operations.

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a user without the "admin" or "power" roles could view dashboard and report listings beyond the requested filter scope while remaining within accessible objects. The vulnerability exists because Splunk Secure Gateway does not neutralize special characters in values before creating filters.

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could move field extractions or field transformations to apps for which the user does not have read access. The vulnerability is possible because the Representational State Transfer (REST) API does not validate destination app access before it processes field extraction and field transformation move operations.

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a low-privileged user that does not hold the "admin" Splunk role or the "sc_admin" Splunk Secure Gateway role could read mobile alert notification data for other users through Splunk Secure Gateway App Key Value Store (KV Store) Representational State Transfer (REST) API endpoints. The vulnerability is possible because the affected Splunk Secure Gateway App Key Value Store collections do not enforce user-level authorization for read requests.

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could make the Splunk Enterprise instance unavailable to other users by sending a request to the REST API endpoint for lookup table files. The affected instance requires a restart to restore service because the endpoint does not limit resource use when it processes response field selections.

In Splunk Enterprise versions below 10.4.4, a user holding a role with the preview_data_management_pipeline or edit_data_management_pipeline_job capability could read or delete Data Management SPL2 preview jobs and results outside their ownership scope. The vulnerability exists because the Data Management REST API verifies the required capability but does not verify that the requested preview job belongs to the requester. The affected API is available only when the Edge Processor feature is enabled, which is off by default.

A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password. Successful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on behalf of the affected user.

In Laravel from 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database operation on a related table instead of retrieving data. A user with read access but no write permission can empty related-table data, causing irreversible data loss, denial of service, and loss of data integrity.

Pillow versions 11.2.1 through 13.0.0 incorrectly assume image rows are tightly contiguous when exporting to Arrow. When PILLOW_ALIGNMENT causes row padding or an aligned offset before the first row, the resulting Arrow buffer may include uninitialized padding, bytes preceding the first row, or stale heap contents from previously freed images. This can disclose one user's pixels or other process memory to another user.