CVE Vulnerability Catalog

The Grav API Plugin is a RESTful API for Grav CMS that provides full access to content, media, configuration, and user management. Prior to version 1.0.0-beta.15, there is a vulnerability related to insecure direct object reference and logic flaw, allowing authenticated users to modify their own permissions.

Prior to version 2.1.2, OWASP BLT contained a vulnerability where the .github/workflows/pre-commit-fix.yaml file used pull_request_target, allowing code execution from the attacker's fork, enabling remote code execution (RCE) with write permissions.

Podatność w Clerk JavaScript pozwala na nieautoryzowany dostęp do zastrzeżonych akcji, gdy funkcje has() i auth.protect() zwracają wartość true w sytuacjach, gdzie powinny zwracać false. Problem ten występuje w różnych SDK związanych z autoryzacją i może być obejściem w określonych warunkach.

In Meari IoT SDK embedded in CloudEdge 5.5.0, Arenti 1.8.1, and white-label Android apps <= 1.8.x, multiple security-critical secrets are hardcoded and shared, including API signing material, password-transport keying, and service access keys.

In the Meari IoT SDK, in image handling (libmrplayer.so), a vulnerability exists related to baby monitor '.jpgx3' files that use reversible XOR only on the first 1024 bytes with a predictable key derivation model.

In Meari IoT Cloud, alert images stored on Alibaba OSS can be retrieved without authentication, signed URLs, or expiry enforcement. URLs act as direct object references and remain valid beyond expected operational windows.

In Meari client applications embedding 'com.meari.sdk', there is a vulnerability that allows retrieval of WAN IP data for arbitrary devices. The issue stems from a server-side authorization failure in the 'GET /openapi/device/status' request.

In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the user does not own. The broker enforces publish restrictions but does not enforce equivalent subscribe authorization at per-device scope.

The flash-attention project contains a code injection vulnerability in its training script, allowing arbitrary Python code execution via malicious configuration files.

The flash-attention training framework contains an insecure deserialization vulnerability in its checkpoint loading mechanism. The load_checkpoint() function and the checkpoint loading code in eval.py use torch.load() without enabling the weights_only=True parameter, allowing the deserialization of arbitrary Python objects.

CosyVoice contains an insecure deserialization vulnerability in its gRPC server component. The issue arises because the server loads the speech synthesis model from a user-specified directory without enabling the weights_only=True security parameter, allowing the deserialization of arbitrary Python objects.

CosyVoice contains an insecure deserialization vulnerability in its average_model.py model averaging tool. The issue is that the script loads PyTorch checkpoint files without enabling the weights_only=True security parameter, allowing the deserialization of arbitrary Python objects.

CosyVoice contains an insecure deserialization vulnerability in the make_parquet_list.py data processing tool. The script loads .pt files without enabling the weights_only=True security parameter, allowing the deserialization of arbitrary Python objects.

Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks through version 2.61.0. An attacker can craft a malicious XML file with nested entity definitions, leading to excessive resource consumption during processing by the Docling parser.

There is a path traversal vulnerability using symbolic links in pgAdmin 4 File Manager. An authenticated user can create a symbolic link in their directory pointing outside of it, allowing data to be written to any path accessible by the pgAdmin process.

In pgAdmin 4 FileBackedSessionManager, there is a vulnerability to deserialization of untrusted data, which can lead to remote code execution at the operating system level. This issue arises from the lack of proper integrity checks before deserializing session file contents.

In pgAdmin 4 before version 9.15, there is an OS command injection vulnerability (CWE-78) in the Import/Export query export feature. An authenticated user could inject malicious commands, leading to arbitrary command execution on the pgAdmin server or arbitrary file writes.

A SQL injection vulnerability in the pgAdmin 4 Maintenance Tool allows an authenticated user with tools_maintenance permissions to execute arbitrary SQL commands on the PostgreSQL server. Exploiting this vulnerability could lead to privilege escalation and execution of operating system commands on the database host.

Grav is a file-based web platform. Prior to version 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulnerability allowed publisher-level accounts to execute arbitrary JavaScript.

Grav is a file-based web platform. Prior to version 2.0.0-beta.2, a low-privileged user could inject an svg element, leading to an XSS attack that could escalate to dumping system information available under /admin/config/info when a Super Admin visits the page.