CVE Vulnerability Catalog

A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered before the Configure OTP action in a realm, the system may fail to enforce mandatory multi-factor authentication enrollment during the login process. This issue allows an attacker with a valid password to access an account without setting up the required one-time password (OTP) credential.

In leomoon-studios wiki-go up to 1.9.1, the SaveHandler/SourceHandler functions in internal/handlers/editor.go (API component) are vulnerable to path traversal via input manipulation. The attack can be launched remotely, and a public exploit may be used in attacks.

In leomoon-studios wiki-go up to 1.9.1, the RenameFileHandler function in internal/handlers/files.go (Files Rename API component) is vulnerable to path traversal via manipulation of the currentPath/newName arguments. The attack can be initiated remotely, and a public exploit may be used in attacks.

A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadata_api.go of the fetch-metadata Endpoint component. Such manipulation leads to server-side request forgery. The attack can be launched remotely and the exploit is publicly available.

A flaw was found in HarnessRouter up to 0.31.12 affecting an unknown function in gateway/app.py of the Targets Test Endpoint component. Manipulating the base_url argument can lead to server-side request forgery, exploitable remotely.

Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports. This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0.

Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until the connection times out, because it waits for the trailer bytes it has already dropped. Trailer dropping is on by default in 10.x. In 8.1.11 and 9.2.x it is off by default, and those versions are affected only if it is enabled. This issue affects Apache Traffic Server: 8.1.11, from 9.2.5 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.

The Nuvoton NPCX eSPI driver's espi_taf_parse() processes TAF requests without validating the 12-bit length field from the request header. For write and RPMC OP1 requests it copies up to 255 words into a fixed 16-word buffer in a static structure, causing an out-of-bounds write of roughly 956 bytes into .bss and reads past neighbouring eSPI registers. The same unvalidated length is passed to flash_write(), letting the host read up to 4 KB of adjacent controller SRAM.

The Infineon PSOC 6 BLESS HCI driver stored the outgoing HCI packet descriptor in a file-scope variable shared across threads, while the serialising semaphore protected only the call into the controller, not the shared state that call reads. Concurrent transmissions from different threads can cause the controller to receive a descriptor with mismatched fields (dataLength from one buffer, data pointer from another), leading to disclosure of adjacent RAM or loss/duplication of HCI packets.

The Broadcom AFBR-S50 time-of-flight sensor driver in Zephyr RTOS double-completes an RTIO submission when sensor data evaluation fails. The error branch in data_ready_work_handler() calls handle_error_on_result() but does not return, so the same struct rtio_iodev_sqe is finalised a second time via rtio_iodev_sqe_ok(). This causes use-after-free, double-free of the pool entry, and writes through a released buffer.

A vulnerability in the Zephyr device multiplexer pseudo-driver (devmux) is caused by missing permission validation in the syscall verifiers for user-mode callers. With CONFIG_USERSPACE and CONFIG_DEVMUX enabled, a user thread can read and change the multiplexer's downstream device selection without authorization, because devmux devices are not registered as kernel objects and cannot be subject to access control.

A vulnerability was detected in HarnessRouter up to 0.31.10 in the file gateway/app.py of the Identity Mode component. Manipulating the X-Harness-Org/X-Harness-Member arguments results in improper authorization. The attack is remotely possible, with high complexity and difficult exploitability.

A security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.0 in the mysqli_query function of profile.php. Manipulation of the admin_id argument leads to SQL injection. The attack can be carried out remotely, and the exploit has been publicly disclosed.

Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file, or to the 'oratab' file itself, to execute code as root if an agent has the 'mk-oracle' plugin enabled.

The Tailored Tools plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability that allows forcing unintended actions on behalf of a logged-in user. This issue affects Tailored Tools versions up to and including 3.0.3.

In Apache Pulsar, the functions connectors endpoint (/admin/v2/functions/connectors and /admin/v3/functions/connectors) returns the IO connector catalog without requiring super-user access, whereas the worker connectors endpoint enforces this check. As a result, any authenticated client can read the connector catalog metadata regardless of its role permissions. The issue affects versions from 2.4.1 before 4.0.14 and from 4.1.0 before 4.2.5.

The vulnerability affects the Apache Pulsar Functions Worker REST API trigger endpoint. The Worker publishes a message to the function's input topic using its own broker-client credentials rather than the caller's credentials, and does not verify that the caller is authorized to produce to that topic. Versions before 2.4.0 perform no caller authorization check for this endpoint at all.

BusyBox libarchive contains a symlink directory traversal vulnerability allowing remote attackers to create arbitrary files. User interaction is required: the target must visit a malicious page or open a malicious file. The flaw results from lack of proper validation of a user-supplied path before use in file operations.

gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../' sequences, causing os.RemoveAll to delete any directory writable by the server process.

pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. An attacker supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF.