CVE Vulnerability Catalog

The SCRAM code in PgBouncer before version 1.25.2 does not correctly check the return value of strlcat() when building the client-final-message. A malicious backend sending a server-final-message with a long nonce can trigger a stack overflow.

An integer overflow in network packet parsing in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.

Vulnerability in Spring AI's MilvusVectorStore#doDelete(List) implementation allows filter-expression injection via unsanitized document IDs. Affects Spring AI 1.0.x (up to 1.0.7) and 1.1.x (up to 1.1.6).

Linkwarden versions 2.14.0 and earlier do not sanitize HTML files uploaded as archives. The endpoint /api/v1/archives/[linkId]?format=4 accepts HTML files with JavaScript, which is then served from the same origin without a Content-Security-Policy header. This allows arbitrary JavaScript execution in the context of an authenticated user session.

Postiz from version 2.21.6 to before 2.21.7 allows any authenticated user who can create a post to store arbitrary HTML in post content. The public preview link renders that HTML with dangerouslySetInnerHTML on the main application origin.

Termix is a web-based server management platform that prior to version 2.1.0 had vulnerabilities in the extractArchive and compressFiles endpoints. The use of double quotes for shell command construction allowed command injection on the remote SSH host.

Termix is a web-based server management platform that prior to version 2.1.0 issued a temporary JWT for TOTP-enabled accounts. This token, which should only be used in the two-factor authentication process, was accepted by the auth middleware on standard endpoints, effectively reducing security to single-factor.

Pygeoapi versions 0.23.0 through 0.23.3 have a vulnerability that allows using the subscriber object to make requests to internal HTTP services during OGC API process execution. This issue is fixed in version 0.23.3.

pygeoapi versions 0.23.0 through 0.23.2 have a path concatenation vulnerability in the STAC FileSystemProvider plugin. Lack of URL normalization may allow unauthenticated access to directories when deployed without a proxy that normalizes '..' in URLs.

FastGPT up to version 4.14.11 has an SSRF vulnerability in isInternalAddress() that uses startsWith() against a hardcoded list. Bypass is possible via at least 7 URL encoding techniques. Private IP checking is disabled by default.

New API up to version 0.11.9-alpha.1 does not block the address 0.0.0.0 in SSRF protection. A regular user with a valid API token can send requests with 0.0.0.0 as host, bypassing private-IP filters and causing requests to localhost. With AWS/Bedrock Claude adapter, this becomes a full-read SSRF.

The vulnerability in ipl/web allows an attacker to inject malicious Javascript into a victim's browser to run it in the context of Icinga Web. Versions 0.13.1 and 0.10.3 contain patches that address this issue.

Cilium, a networking, observability, and security solution, prior to versions 1.17.15, 1.18.9, and 1.19.3, could output sensitive data when the cilium-bugtool was run against deployments with WireGuard encryption enabled.

In the New API artificial intelligence asset management system, prior to version 0.12.10, a vulnerability existed in the Stripe webhook handler that allowed an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without making any payment.

Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allowed attackers to trick authenticated administrators into performing unauthorized actions like system registration, plugin management, and configuration changes.

The SolidCAM-GPPL-IDE extension in versions from 1.0.0 to before 1.0.2 has a vulnerability that allows the processing of malicious .vmid files, potentially leading to local file disclosure and denial of service attacks.

In the Avo framework, prior to version 3.31.2, a broken access control vulnerability was identified in the ActionsController. It allows an authenticated user to execute any Action class on any resource, leading to privilege escalation and unauthorized data manipulation.

Ray is an AI compute engine that, from version 2.54.0 to before 2.55.0, registered custom Arrow extension types in PyArrow. As a result, when reading a Parquet file containing these types, arbitrary code execution is possible due to improper handling of metadata.

MailEnable Enterprise Premium w wersji 10.55 i wcześniejszych zawiera lukę w autoryzacji w mobilnym portalu WebAdmin, która pozwala atakującym na ominięcie kontroli uwierzytelniania poprzez ponowne wykorzystanie ciasteczek AuthenticationToken generowanych dla użytkowników o niskich uprawnieniach. Atakujący mogą uzyskać token z punktu logowania WebMail, używając parametru PersistentLogin i wykorzystać go w portalu WebAdmin do wykonywania działań administracyjnych z wysokimi uprawnieniami.

SmarterTools SmarterMail w wersjach przed 9560 zawiera podatność na lokalne włączenie pliku w punkcie końcowym API /api/v1/report/summary/{type}, co pozwala uwierzytelnionym użytkownikom na odczyt dowolnych plików .json w systemie. Atakujący mogą wykorzystać tę podatność w połączeniu z słabymi algorytmami szyfrowania i hardcodowanymi kluczami.