CVE Vulnerability Catalog

Sakai versions from 23.0 to 23.5 and 25.3 have a vulnerability where an authenticated user can delete another user's profile image via the DELETE /api/users/{userId}/profile/image endpoint, because ProfileController.removeProfileImage() passes the attacker-controlled userId to ProfileServiceImpl.removeProfileImage() without verifying ownership. Similarly, the DELETE /api/users/{userId}/profile/pronunciation endpoint also omits session validation and ownership checks before deleting the target user's recording.

Bugsink before version 2.2.2 stores every set of custom tags supplied with an incoming event, allowing a caller with a valid project DSN to submit an unusually large tag set and force excessive tag-row writes. Because of the single-writer database architecture, the expensive write transaction delays digestion of other events and causes a temporary ingestion denial of service.

Inspektor Gadget from version 0.27.0 to 0.53.1 has a vulnerability in the uprobe library resolver that can allow an unprivileged container to consume excessive CPU and block other containers from starting by supplying a crafted /etc/ld.so.cache file while an uprobe-based gadget is active. The parser in pkg/uprobetracer/ldcache_parser.go trusts EntryCount enough to perform excessive iteration, computes cache1Len with overflowing uint32 arithmetic, and repeatedly calls readStringFromBytes, where byte-by-byte immutable string concatenation produces quadratic work.

Bambuddy versions 0.1.6 through before 0.2.4.4 contain a fail-open in the authentication code. An attacker can bypass authentication by flooding a public endpoint to exhaust resources, causing database access to fail and granting unauthenticated access to all protected endpoints.

MitraStar GPT-2742GX4X5v6-SV version GL_g2.5_100XNT0b23_3 contains a vulnerability in the /cgi-bin/device-management-utilities-internet.cgi component that allows an authenticated attacker to execute arbitrary code.

Apptainer before version 1.5.1 has a vulnerability in Image.AuthorizedPath that applies plain string-prefix matching to the limit container paths directive in apptainer.conf, so an allowed path such as /data/safe also authorizes a sibling path such as /data/safe-but-unsafe. A local user can consequently run a container from a directory outside the administrator's intended allowlist when Apptainer operates in setuid mode.

In DIRAC prior to versions 8.0.79, 9.0.22, and 9.1.10, the export_getRequestCountersWeb function in ReqManagerHandler.py passes an authenticated caller-controlled groupingAttribute to getRequestCountersWeb in RequestDB.py. An unrecognized value is resolved against the Request object and evaluated as Python code, allowing a crafted dunder attribute expression to reach operating-system functions and execute commands.

OpenCost prior to 1.121.0 exposes the POST /serviceKey endpoint, allowing a network client to invoke AddServiceKey without mandatory authentication and write an arbitrary key value to the GCP service-account key.json file. The attacker controls the file contents but not the directory, filename, or file mode.

CrowdStrike released a security update for the Falcon sensor for Windows addressing a vulnerability that exists only when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled. The vulnerability could expose an arbitrary file write to protected locations from an unprivileged context, potentially leading to local privilege escalation.

BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the component Trufflebox UI (trufflebox-ui) in ExpressionViewModal.jsx.

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page.

BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (XSS) in the component Trufflebox UI (trufflebox-ui) in GenericNumerixTable.jsx.

Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edit_user_properties permissions on the REST API user write endpoints (PUT /ccm/api/1.0/users/{uID} and POST /ccm/api/1.0/users/{uID}/change_password). A user with an update-scoped OAuth token and permission to edit only one field could change another non-superuser's password, username, email, and attributes, taking over that account.

In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page. A user who could create or rename pages could store a script through a child page name that would run in the browser of any visitor, editor, or administrator viewing the navigation.

GitLab CE/EE versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 contain a vulnerability that under certain conditions allows an authenticated user to access CI/CD variables outside their intended environment scope. The cause is improper input validation in the environment scope pattern matcher.

GitLab CE/EE versions from 18.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 have a vulnerability that under certain conditions could have allowed an authenticated user to bypass SAML SSO sign-in restrictions and authenticate without SSO due to missing authentication enforcement checks.

IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

IBM Cloud Pak for Business Automation is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.