CVE Vulnerability Catalog

A cross-site scripting (XSS) vulnerability was found in Apache Syncope due to improper input neutralization during web page generation. The notification message shown on Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline via malicious HTTP link generation. Affects versions from 4.0.4 through 4.0.7 and from 4.1.0-M0 through 4.1.2.

In Eclipse Embedded CDT versions 6.0 to 6.7, extracting a compromised CMSIS-Pack archive can write files to locations outside the pack directory. This allows arbitrary files to be written to other locations on disk (path traversal / Zip Slip).

In Apache Syncope, an administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression that allows any administrator with sufficient User read entitlements to access sensitive information of LinkedAccount or Manager, possibly including hashed credentials. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

Apache Syncope has an incorrect authorization vulnerability. An administrator with ClientApp's update entitlement is unable to perform the related operation, while ClientApp's create entitlement is checked both for create and update operations on ClientApp.

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

Apache Syncope has an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized entityKey and opEvent parameters.

Apache Syncope has a missing authorization vulnerability. An administrator with task execution entitlements might be able to mass (de)provision group members, regardless of their group-related administration capabilities.

In Apache Syncope, audit events sent to the configured store are not sufficiently masked for the sensitive values they might carry, allowing administrators to access such sensitive values. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

Apache Syncope has an incorrect authorization vulnerability. An administrator with adequate entitlements in a given Realm may be able to read via REST the full Connector configuration, confidential properties included, scoped in another Realm and thus be able to effectively duplicate such Connector instance into the Realm they have administration rights for.

Apache Syncope has an incorrect authorization vulnerability. Search requests are transformed into SQL, Neo4J or Elasticsearch/Opensearch queries, and the Realms filter that should restrict results to the requester's permissions may be rendered as empty for non-recursive search requests, voiding privilege restrictions.

Apache Syncope has an improper privilege management vulnerability. Delegations can be created or updated with Roles not owned by the delegating User, or not for the same Realm subtree under which delegation management was granted.

A vulnerability in Apache Syncope allows an administrator with adequate entitlements to access via REST the list of existing Access Tokens, including their signed JWT body. These tokens can then be used for further REST requests, impersonating users with higher administration privileges.

Inadequate access control exists in Hiperdino's REST v1.0 API. The public endpoint 'customer/check' allows an authenticated attacker to enter a telephone number or email address; when the value belongs to a registered customer, the service returns the associated information (email address and telephone number). No authentication is required beyond a static bearer token, and there is no rate limiting or generic error handling.

Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/configfiles/, even though the file contains the Froxlor SQL user's password. On systems where the parent directories are world readable (the default on Debian 12), any unprivileged local user able to execute commands or code on the host — including virtual users without SSH access who can upload PHP/CGI scripts — can read the file and obtain the Froxlor database credentials. Database access can then be leveraged to alter an administrator's password hash and TOTP seed, log in as a Froxlor administrator, and ultimately gain root privileges. Only instances configured to use pure-ftpd are affected.

LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visual_register WebSocket endpoint, which passes the first client frame directly to pickle.loads(). Attackers can reach the Config Server port and send a malicious serialized payload with a __reduce__ method to execute arbitrary code with Config Server process privileges.

A vulnerability was identified in Gitlawb openclaude up to 0.30.0. Impacted is the function waitForCallback of the file src/services/api/xaiOAuthCallback.ts of the component xAI OAuth Callback Handler. The manipulation of the argument Error leads to denial of service. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in taisan tarzan-cms 1.0.0 in the openConnection function of com/tarzan/cms/modules/admin/service/biz/ThemeService.java, within the theme download component. Manipulating the httpUrl argument leads to server-side request forgery (SSRF). The exploit has been publicly disclosed and the project has not yet responded to the issue report.

A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the component Admin Console. Such manipulation of the argument text leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

In the Joomla extension - SP Page Builder Pro (versions 3.2.6 - 5.6.1p2 and 6.0.0 - 6.9.0) in the Contact, Opt-in and Form Builder addons, there is an unauthenticated CAPTCHA bypass in module context. In the ajax_contact, optin_form and form_builder addons, the result returned by the CAPTCHA plugin's onCheckAnswer event was discarded and replaced with a test for a non-empty string whenever the request-supplied view_type parameter equaled 'module'. Submitting view_type=module together with any arbitrary token value therefore passed verification. This affected every instance of these addons placed inside an SP Page Builder module, irrespective of the CAPTCHA type configured for the site, and the view_type parameter was never validated against the context in which the form was actually rendered.

An improper validation vulnerability exists in PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. In certain configurations this could allow an attacker to bypass authentication controls via spoofing, leading to privilege escalation or impersonation.