CVE Vulnerability Catalog

The DRPC server in Apache Storm keeps a map from function names to request queues, and entries are never removed. An attacker can send arbitrary function names without authentication (as `drpc.authorizer` is disabled by default), leading to unbounded memory growth and eventual heap exhaustion.

Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race condition vulnerability that allows authenticated attackers to interrupt active diagnostic processes by concurrently deleting output files written to predictable paths under the diagnostic directory. Attackers can trigger a diagnostic operation such as traceroute or ping and simultaneously invoke the file deletion endpoint to terminate the running process, leaving the system in an inconsistent state.

An incorrect authorization vulnerability in Apache Syncope affects the Reconciliation service (pull and push). Due to incomplete delegated administration security checks, calls by administrators lacking proper entitlements may be accepted, enabling unauthorized actions.

An incorrect authorization vulnerability in Apache Syncope stems from flawed implementation of Realm hierarchy-based checks. Permission enforcement uses prefix matching, making it impossible to correctly distinguish between two sibling Realms whose names begin with the same string, leading to unauthorized access.

Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in one of their own plain attributes. When such users are included in a CSV export and the generated CSV file is opened by a spreadsheet application, the formula may be executed. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

An Open Redirect vulnerability in Apache Syncope affects the SRA (Syncope REST API) when configured for CAS authentication. The target Apereo CAS instance's URL is calculated unconditionally from client-supplied forwarded HTTP headers, allowing an attacker to control the redirect destination.

Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. Malicious scripts inside SVG can execute when the SVG is navigated to directly or embedded as a document, running on the MISP origin with the viewer's session. This affects organisation SVG logos and event-report SVG pictures. The vulnerable behavior is on the serve path, not merely the upload path. Version affected: ≤2.5.45.

Affected versions of MISP's interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging. The legacy SysLogLogable behavior stored that identity in behavior-instance state that could be overwritten when another model lazily attached the shared behavior. Consequently, subsequent CLI writes could lose the intended user attribution and be logged incorrectly. The commit also notes that CLI-originated records lacked a CLI marker, making them appear similar to ordinary web actions by that user. Version affected: ≤2.5.45.

LangBot's plugin runtime (pip package langbot_plugin) through version 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 with authentication based on a key that defaults to an empty string and is never set. A remote attacker can register an arbitrary 'debug plugin' without credentials, receive full context of IM messages, inject forged replies, send messages as bots, read knowledge bases, and register malicious tools.

Froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Malicious URLs containing literal newlines are written verbatim into vhost config files during cron rebuild, enabling web server configuration corruption, denial of service, or hijacking of HTTP responses across hosted domains.

Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender values by supplying arbitrary senderid parameters in delete confirmation requests.

Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypassing per-customer access controls.

EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent event permissions instead of attendee entity permissions.

laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove endpoints to disclose confidential license keys, inject attacker-controlled values, or delete stored licenses entirely.

LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in core-upgrade backup handling. CoreUpgradeController and BackupService concatenate the user-supplied backup_file/filename value directly onto the backup directory path without normalisation, without basename(), and without verifying that the resolved path remains inside storage/app/core-backups; an authenticated user holding only the delegated settings.edit permission can supply ../ traversal sequences to delete arbitrary files or restore a ZIP archive from an arbitrary on-disk location, writing arbitrary files into application directories and achieving remote code execution.

LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing script tags. When any user including administrators opens the stored SVG file served inline from the application origin, the embedded JavaScript executes in the dashboard context, enabling session hijacking and administrative account takeover.

File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules. Attackers can read and overwrite rule-denied files by accessing them through in-scope symbolic link aliases that resolve to denied paths.

File Browser versions >= 2.5.0 and <= 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint (resourcePostHandler in http/resource.go). Unlike the TUS upload handler, the direct-upload handler does not reject a target that is an existing directory; a POST with ?override=true aimed at a directory fails inside writeFile and the failure-cleanup path calls Fs.RemoveAll on the request path, recursively deleting the entire tree. This cleanup is not gated by Perm.Delete or the checkDescendants rule, so an authenticated non-administrator with default Create and Modify permissions can delete directories they are not authorized to delete.

File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory without size limits. Authenticated attackers with download permission can request conversion of large .srt, .ass, or .ssa files and exhaust server memory through concurrent requests, causing denial of service.

filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffer arbitrarily large messages. Attackers can send oversized WebSocket messages to exhaust server heap memory and cause denial of service regardless of EnableExec setting or Execute permission.