CVE Vulnerability Catalog

MISP contains an insecure default configuration where the Security.check_sec_fetch_site_header control is disabled. This allows remote unauthenticated attackers to send malicious requests to MISP automation endpoints on behalf of authenticated users.

MISP has an incorrect authorization vulnerability that allows an organization administrator to target site administrator accounts belonging to the same organization through the administrative email functionality. The affected code restricted organization administrators to users within their own organization but did not exclude site administrator role accounts from recipient queries.

AgenticMail prior to version 0.9.27 exposed a Streamable HTTP transport without an authentication layer, allowing remote clients to directly call tools. This issue has been patched in version 0.9.27.

Koel is a free, open-source music streaming solution. In versions prior to 9.3.5, Koel did not properly validate podcast episode URLs, allowing for SSRF attacks against internal services.

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal can cause kitty to execute attacker-supplied Python inside the running kitty process with the user's full privileges.

In versions prior to 0.47.0 of the Kitty terminal, it is possible to inject commands into the subshell through a Kitty error. A special escape code causes Kitty to return an error that is not properly escaped and is correctly echoed back to the terminal, allowing it to be executed by the shell in use.

In Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS, improper authorization in the handler for custom URL scheme may allow an unauthenticated user to conduct an escalation of privilege via network access.

Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an escalation of privilege via network access.

The Naxclow platform API that returns device relay registration details exposes a persistent credential without verifying that the requester is the legitimate device or owner. An actor able to present a platform-valid request signature can retrieve credentials for arbitrary devices and register on the relay as that device.

Naxclow devices use a static relay credential that is not rotated and is re-issued to the device on each boot. This credential remains valid indefinitely and cannot be reset or revoked by the legitimate owner.

Parse Server prior to versions 8.6.77 and 9.9.1-alpha.1 is vulnerable to an attack where an unauthenticated user can send a malicious HTTP request, leading to excessive CPU consumption on the server.

A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently reassign a device to an arbitrary account.

In Moby, versions prior to 2.0.0-beta.14 and Docker Engine prior to 29.5.1, a race condition during mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path. This can lead to overwriting host files or denial of service.

The form-data library before versions 2.5.6, 3.0.5, and 4.0.6 does not escape CR, LF, and double-quote characters in field names and filename options, allowing header injection or smuggling of additional multipart parts. The attack requires the application to pass untrusted data as a field name.

Improper handling of HPACK dynamic table size updates in the AWS Common Runtime aws-c-http library might allow a remote threat actor operating a server to cause memory corruption on a connecting client application, potentially leading to arbitrary code execution.

Insufficient verification of data authenticity in the remote control feature of Zoom Contact Center for Windows before version 7.0.0 may allow an authenticated user to escalate privileges via local access.

A vulnerability in MariaDB server allows a high-privileged user to execute shell commands via the wsrep_sst_receive_address or wsrep_sst_donor global system variables. Affected versions range from 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1.

A vulnerability in MariaDB allows a malicious joiner node to execute arbitrary shell commands on the donor node during the SST (State Snapshot Transfer) process using the rsync method. The issue stems from insufficient validation of parameters sent by the joiner, which are interpolated into the command line on the donor side.

Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Typesense, a typo-tolerant search engine, has an unauthenticated denial-of-service vulnerability in the /multi_search endpoint prior to versions 29.1 and 30.2. A specially crafted request can trigger an unhandled exception, causing the server process to terminate.