CVE Vulnerability Catalog

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. Nothing serialises the token's validity check against its consumption, so concurrent redemptions of one token all succeed and each yields a full user token. Revocation happens only after JWT verification, and the revocation is written as an upsert, so a concurrent duplicate revocation silently succeeds.

An inefficient algorithmic complexity vulnerability in AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in an API key. The decoding functions have quadratic/cubic complexity and do not limit input length.

Use of a one-way hash with a predictable salt in team-alembic AshAuthentication allows readers of the audit store to recover client IP addresses that the :hash privacy mode is supposed to pseudonymise. The hash_ip/1 function uses a single unkeyed SHA-256 hash with a salt that defaults to a constant published in the source code, allowing full precomputation of the hash table for the IPv4 address space. Truncation to 16 hex characters does not prevent recovery, and even a properly configured salt can be brute-forced once leaked.

A vulnerability in the AshAuthentication library (audit_log add-on) causes the full user record, including the hashed_password attribute, to be stored in the audit log when an audited action is invoked with an actor set. Marking the attribute as sensitive does not help because redaction only applies to inspect/1 output, not JSON encoding or raw-term storage. The issue affects versions from 4.12.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.2.

An authorization bypass vulnerability in AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, leading to account takeover. A confirmation token issued for one user is accepted on another user's record.

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid header value from an inbound JWT without sanitizing path traversal characters or query-string separators. This allows an unauthenticated remote attacker to force the application server to issue GET requests to arbitrary paths on the same origin as the configured key endpoint.

An insufficient session expiration flaw in AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign the victim into an attacker-controlled account. The session entry is never removed on failed authentication paths due to improper Elixir scoping, so the CSRF-protection value persists across cancelled or failed attempts until the next request or session expiry.

The "Use of HTTP Request With Sensitive Query String" vulnerability in AshAuthenticationPhoenix causes a single-use sign-in token to be passed as a query parameter in the URL during login redirect. The token can be exposed in server logs, browser history, etc.

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker.

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.

Dell OpenManage Server Administrator versions prior to 11.1.0.3 contain an improper privilege management vulnerability. A low-privileged attacker with remote access could potentially exploit this to tamper with information and gain unauthorized access.

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.

An improper authentication vulnerability in AshAuthentication allows an attacker with a sign-in token for one authenticated resource to be signed in as a user of a different resource. The issue arises from incorrect parsing of the sub claim in the JWT token.

Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions. The vulnerability allows bypassing access controls without authentication.

The Xagio SEO plugin in versions up to and including 7.1.0.43 contains an Unauthenticated Cross Site Request Forgery (CSRF) vulnerability. The lack of CSRF protection allows an attacker to force a logged-in user to perform unwanted actions.

Cross Site Scripting (XSS) vulnerability in Geo Mashup plugin up to version 1.13.21. A user with Contributor role can inject malicious script into the page. This allows arbitrary JavaScript execution in a victim's browser.

Vulnerability in AshAuthentication library (versions from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14) concerning improper verification of cryptographic signature. The token revocation mechanism does not verify signature, allowing an attacker to neutralize revocations or write arbitrary rows into the token resource.

Unauthenticated Broken Access Control vulnerability in User Registration plugin up to version 5.2.7. Unauthenticated users can access restricted functionality, such as admin panel or sensitive resources.

Cross Site Request Forgery (CSRF) vulnerability in PublishPress Series plugin up to version 3.1.3. CSRF attacks can be performed without authentication, allowing forced actions on behalf of a logged-in admin.

Unauthenticated Broken Access Control vulnerability in Booking Calendar plugin up to version 11.7. Unauthenticated users can access booking and management functions that should be restricted.