CVE Vulnerability Catalog

When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password.

In virtualenv before 21.14.9, the safe_delete() deletion error handler responds to a failed removal by reading mode bits with os.lstat(path) and applying owner-write permission with os.chmod(path, ...), which follows a symlink. A planted link inside a read-only directory can cause a victim-owned target outside the destination to become broadly writable.

In virtualenv before 21.14.9, ViaTemplateActivator._generate() removes an existing output only when Path.exists() is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write() opens pyvenv.cfg without first replacing an existing symbolic or hard link. Another local account can cause files outside the requested tree to be created or overwritten.

In virtualenv before 21.14.9, the app-data copy seeder uses shutil.copy() to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can produce files writable by another local account in a later traversable environment.

In virtualenv before 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause files outside the environment to be deleted.

In virtualenv before 21.14.9, the builtin creator calls ensure_dir() for executable, library, and package directories, and ensure_dir() accepts an existing symlink to a directory because exists() follows it. Interpreter creation, seed installation, and activation generation then write through the linked parent outside the requested destination.

The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first data packet after the TCP handshake, using only LZ4 compression rather than encryption. An attacker on the network path can passively intercept and decompress this packet to reveal the plaintext JSON payload.

In virtualenv versions 21.14.8 through 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. Enabling symlink_app_data via environment variable or configuration file can trigger this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname its owner no longer controls. This is fixed in version 21.14.10.

Cachet versions 2.4.1 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability in the incident creation form. An authenticated attacker can inject malicious HTML/JavaScript that executes in the browser of any user viewing the status page, potentially leading to session token theft and account takeover. Commits 57b44a8bac0b250b0d5751e93e0349070d14606e and 23adbb88ffa819f92be4a905ff1d812670d980a2 in cachethq/core patch the issue.

EspoCRM up to 9.3.10/10.0.10 has a vulnerability in the ImageSourceProvider::get function in application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php within the PDF Rendering Pipeline component. Manipulating the ID argument results in authorization bypass. The attack may be initiated remotely. The patch is named 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2 and installing it is recommended.

A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring screen. Malicious data stored in logs may execute as script in the browser of a user viewing that screen.

Acrobat for Edge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.

ApostropheCMS prior to 4.33.0 has a self-service password-change endpoint that verifies the current password but does not use the login module's failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving a lockout or throttle response. This is fixed in version 4.33.0.

In ApostropheCMS AI helper versions 1.0.0-beta.10 through 1.0.0-beta.13, an editor with image-generation capability can create a base64-generated image record without a stored provider URL and invoke image acceptance on a deployment using local relative storage with no trusted global base URL. The server resolves the fixed uploads path against a request-controlled Host-derived origin, enabling bounded server-side requests to an attacker-selected host, port, and HTTP origin, but not arbitrary-path retrieval or stored-provider and absolute-storage configurations. This is fixed in AI helper 1.0.0-beta.13.

ApostropheCMS prior to 4.33.0 has its core page REST API read full page documents with .permission(false) in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: private, and visibility: loginRequired checks. Unauthenticated visitors and low-privilege contributors can read admin-only and non-public page content by _id/slug. This is fixed in version 4.33.0.

In ApostropheCMS prior to 4.33.0 and passport-bridge prior to 1.6.1, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A client that obtains and redeems a still-valid, unconsumed token before its first use can adopt the associated session, including through the passport-bridge cross-locale flow. This is fixed in ApostropheCMS 4.33.0 and passport-bridge 1.6.1.

ApostropheCMS prior to 4.33.0 has a REST route GET /api/v1/<piece-type>/:_id/locales (and the equivalent page route) that does not apply the publicApiCheckAsync gate enforced by other read routes. An unauthenticated caller can query this route for any document _id and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read API is otherwise supposed to gate. This is fixed in version 4.33.0.

In the CAPTCHA integrations (Form, login-recaptcha, login-hcaptcha) for ApostropheCMS, the user-supplied response token is interpolated unencoded into the provider verification request. Crafted tokens can smuggle request parameters and disrupt CAPTCHA verification and CAPTCHA-gated forms or login flows. Automated bypass probing is possible, but a successful CAPTCHA bypass or secret disclosure has not been established.

In the import-export module of ApostropheCMS before 3.7.0, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a write stream emits an unhandled filesystem error that can terminate the Node.js process. The source establishes this static primitive but not an end-to-end exploit or controlled arbitrary file read or write.

In the import-export module of ApostropheCMS before 3.7.0, an authenticated user with import access to a target type can supply an object or operator as an update-key value, causing the import query to match an unidentified existing document that the user has generic edit permission to modify. The normal findForEditing permission filter still limits candidate documents, so the issue does not permit permission-free overwrite of arbitrary protected content.