CVE Vulnerability Catalog

In the YARD documentation tool, prior to version 0.9.42, a path traversal vulnerability was discovered that allowed access to arbitrary files on the YARD server host machine due to unsanitized HTTP requests. This issue has been patched in version 0.9.42.

In Dapr, from versions 1.3.0 to before 1.15.14, 1.16.0-rc.1 to before 1.16.14, and 1.17.0-rc.1 to before 1.17.5, a vulnerability has been found that allows bypassing access control policies for service invocation using reserved URL characters and path traversal sequences. The ACL normalized the method path independently from the dispatch layer, leading to one path being evaluated by the ACL while the target application received a different one.

The optional extension component TinkerpopClientService in Apache NiFi versions 2.0.0-M1 through 2.8.0 is missing the Restricted annotation with the Execute Code Required Permission. This allows users without the necessary permissions to configure the service, potentially leading to unauthorized execution of Groovy scripts.

In the Linux kernel, the panthor DRM driver violates dma-fence safe access rules. The drm_sched_fence_get_timeline_name function can race with group_free_queue, leading to potential use-after-free.

In the Linux kernel, a commit adding an OP-TEE node to the ZynqMP device tree is reverted. Manually defining the optee node in zynqmp.dtsi blocks U-Boot's automatic injection of the reserved-memory node, causing memory access violations at runtime.

Lack of proper authorization implementation in the CashDro 3 web administration panel, version 24.01.00.26. An attacker could modify the binary string in the 'Permissions' field of the JSON response, allowing privilege escalation and full administrative access.

Account users are allowed by default to register templates to be downloaded directly to the primary storage for deploying instances using the KVM hypervisor. Due to missing file name sanitization, an attacker can register malicious templates to execute arbitrary code on the KVM hosts.

Missing MinIO policy cleanup on bucket deletion via Apache CloudStack allows users to retain access to buckets which they previously owned. If another user creates a new bucket with the same name, the previous owners can gain unauthorized read and write access to it.

The Backup plugin in CloudStack has improper access logic in versions 4.21.0.0 and 4.22.0.0. Authenticated users can restore volumes from other users' backups and attach them to their own VMs.

DrayTek Vigor 2960 firmware versions prior to 1.5.1.4 contain an OS command injection vulnerability in the CGI login handler. This allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the formpassword parameter.

The Auto Affiliate Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 6.8.8. This is due to insufficient input sanitization on the 'url' POST parameter and a complete absence of output escaping in functions processing the data.

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Deserialization of Untrusted Data in versions up to and including 4.3.1. This is due to insufficient input validation and type checking on the wpuf_files parameter during form submission.

A vulnerability was found in the Linux kernel's ESP (Encapsulating Security Payload) implementation for IPv4/IPv6. The UDP datagram append paths did not mark shared pipe pages with the SKBFL_SHARED_FRAG flag, allowing in-place decryption without making a private copy. An attacker could exploit this to read or modify ESP data in UDP packets originating from shared pages.

A vulnerability in PredatorSense versions 3.00.3136 to 3.00.3196 allows local privilege escalation. The program exposes a misconfigured Windows Named Pipe, enabling an authenticated local user to execute arbitrary code with SYSTEM privileges and delete arbitrary files with SYSTEM privileges.

The OttoKit: All-in-One Automation Platform WordPress plugin before version 1.1.23 does not properly sanitize user input before using it in SQL statements, which could allow unauthenticated attackers to perform SQL injection attacks.

An issue was discovered in Control Web Panel (CWP) before version 0.9.8.1209, where user input passed via the 'key' GET parameter to /admin/index.php is not properly sanitized. This vulnerability allows unauthenticated attackers to inject and execute arbitrary OS commands with root privileges on the web server.

AstrBot 3.5.15 contains a hardcoded private key 'Advanced_System_for_Text_Response_and_Bot_Operations_Tool' used to sign JWT.

LINQPad before 5.52.01 Pro is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(), leading to code execution.

In versions of yeti-platform before 2.1.12, attackers can generate valid JWT tokens if the secret is not changed (by setting YETI_AUTH_SECRET_KEY to a value other than SECRET).

A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform before version 2.1.12 allows attackers to execute code on the application server.