CVE Vulnerability Catalog

Metabase to platforma analityki danych typu open-source. W wersjach przed 55.13, 56.3 i 57.1, samodzielnie hostowane instancje Metabase, które pozwalają użytkownikom na tworzenie subskrypcji, mogą być narażone, jeśli są współlokalizowane z innymi niezabezpieczonymi zasobami.

Termix, a web-based server management platform, versions 1.7.0 to 1.9.0, has a Stored Cross-Site Scripting (XSS) vulnerability in the File Manager component. The application fails to sanitize SVG file content before rendering, allowing an attacker who has compromised a managed SSH server to plant a malicious file. When previewed by the Termix user, it executes arbitrary JavaScript in the application context. This is fixed in version 1.10.0.

Ollama versions 0.11.5-rc0 through 0.13.5 contain a null pointer dereference vulnerability in the multi-modal model image processing functionality. When processing base64-encoded image data via the /api/chat endpoint, the application fails to validate that the decoded data represents valid media before passing it to the mtmd_helper_bitmap_init_from_buf function. This function can return NULL for malformed input, but the code does not check this return value before dereferencing the pointer in subsequent operations.

A ReDoS vulnerability in LangChain up to version 0.3.1 exists in the MRKLOutputParser.parse() method. An attacker can supply crafted text (e.g., via prompt injection) causing excessive CPU consumption and parsing delays, leading to denial of service.

LlamaIndex versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VannaPack VannaQueryEngine implementation. The custom_query() function generates SQL statements from user-supplied prompts and executes them via vn.run_sql() without enforcing query execution limits, allowing an attacker to trigger expensive SQL operations that exhaust CPU or memory resources.

LlamaIndex versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk(). The function uses pickle.load() to deserialize multi_embed_store.pkl from a user-supplied persist_dir without validation, allowing an attacker to execute arbitrary code by providing a crafted pickle file.

Emlog, an open source website building system, version 2.6.1 and earlier exposes a REST API endpoint (/index.php?rest-api=upload) for media file uploads. The endpoint fails to implement proper validation of file types, extensions, and content, allowing authenticated attackers (with a valid API key or admin session cookie) to upload arbitrary files (including malicious PHP scripts) to the server. An attacker can obtain the API key either by gaining administrator access or via information disclosure vulnerabilities. Once uploaded, the malicious PHP file can be executed to gain remote code execution (RCE) on the target server, leading to full server compromise.

WebErpMesv2 prior to version 1.19 exposes multiple sensitive API endpoints without authentication middleware. An unauthenticated remote attacker can read business-critical data including companies, quotes, orders, tasks, and whiteboards. Limited write access allows creation of company records and full manipulation of collaboration whiteboards.

Gin-vue-admin to system zarządzania zaplecza oparty na Vue i Gin. W wersjach do v2.8.7 występuje podatność na przejście ścieżki w funkcjonalności wznowienia przesyłania plików, co pozwala atakującemu na przesyłanie dowolnych plików do dowolnego katalogu.

Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId.

cpp-httplib prior to version 0.30.1 contains a Denial of Service (DoS) vulnerability due to unsafe handling of compressed HTTP request bodies. The library validates payload_max_length against compressed data size but does not limit the size of decompressed data stored in memory.

A vulnerability in Envoy Gateway before versions 1.5.7 and 1.6.2 allows credential leakage via Lua scripts in EnvoyExtensionPolicy. Leaked credentials can be used to communicate with the control plane and access all secrets used by the proxy, including TLS private keys and communication credentials.

A vulnerability in osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 allows a remote attacker to read arbitrary files from the server via ticket PDF export. The attacker can submit a ticket containing crafted rich-text HTML with PHP filter expressions that are insufficiently sanitized before being processed by the mPDF PDF generator. When the ticket is exported to PDF, the generated file can embed contents of attacker-selected files from the server filesystem as bitmap images, leading to disclosure of sensitive local files in the context of the osTicket application user.

MindsDB, platforma do budowy sztucznej inteligencji, przed wersją 25.11.1 miała podatność na nieautoryzowany atak typu path traversal w API przesyłania plików. Umożliwia to atakującemu odczyt dowolnych plików z systemu plików serwera oraz przeniesienie ich do magazynu MindsDB, co prowadzi do ujawnienia wrażliwych danych.

An issue in Automai Director v.25.2.0 allows a remote attacker to execute arbitrary code via the update mechanism.

An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges and obtain sensitive information via a crafted js file.

W wersjach Errands przed 46.2.10 nie weryfikowane są certyfikaty TLS dla serwerów CalDAV. Może to prowadzić do potencjalnych ataków typu man-in-the-middle.

Weaknesses in the authorization mechanisms of Viafirma Documents v3.7.129 allow an authenticated user without privileges to list and access other user data, use user creation, modification, and deletion features, and escalate privileges by impersonating other users of the application in the generation and signing of documents.

IDOR vulnerability has been found in Viafirma Inbox v4.5.13 that allows any authenticated user without privileges in the application to list all users, access and modify their data. This allows the user's email addresses to be modified and, subsequently, using the password recovery functionality to access the application by impersonating any user, including those with administrative permissions.

Imaster's MEMS Events CRM contains an SQL injection vulnerability in the 'keyword' parameter in '/memsdemo/exchange_offers.php'.