CVE Vulnerability Catalog

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the destination directory, causing the extraction process to write files to arbitrary locations with the privileges of that process.

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitrary operating system commands with the privileges of that process.

A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. This allows an unauthenticated network attacker to craft a link that, when visited by a user, executes arbitrary script in the context of the affected application and can redirect the browser to an arbitrary external site.

ZoneMinder versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse Events=View and/or Snapshots=View permissions to directly fetch media for events belonging to monitors they are not allowed to access. The normal UI hides the restricted monitor, but direct event media views accept an arbitrary eid and stream media without enforcing event/monitor-level ACL.

Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1, a trust-boundary flaw in OCI artifact verification allowed artifact-provided deployment config to influence the policy used to verify that same artifact. When global OCI signature verification was enabled via `OCI_TRUST_POLICY` (`enabled: true`), an attacker with write access to the configured OCI tag could publish an unsigned or improperly signed artifact containing `.doco-cd.yml` with `oci.verify: false`, causing signature verification to be bypassed and untrusted deployment content to be applied.

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer size, allowing a crafted HEVC stream with large dimensions and 16-bit luma samples to cause an integer overflow, an undersized allocation, and an out-of-bounds heap read.

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate pixel offsets, allowing a crafted HEVC stream with large image dimensions to trigger an integer overflow and cause out-of-bounds heap reads or writes.

Hoverfly prior to version 1.12.8 uses http.DefaultClient without any timeout configuration for remote post-serve actions. When the remote endpoint is unreachable or intentionally slow, each triggered proxy request spawns a goroutine that blocks indefinitely on http.DefaultClient.Do().

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the AddDiff() function writes to the shared responsesDiff map without any synchronization (no mutex). When multiple proxy requests are processed concurrently, the concurrent map writes trigger Go's built-in race detector which causes a fatal error: concurrent map read and map write, immediately killing the entire Hoverfly process.

Kimai versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through GET routes and directly create or reuse a Team, add the current user as teamlead, and bind the target object to that team.

libks provides foundational support for signalwire C products. Prior to version 2.0.11, clean_uri() in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with embedded ".." sequences intact, enabling path traversal in any consumer that later joins the URI with a filesystem path.

OpenTelemetry eBPF Profiler starting in version 0.0.202527 and prior to version 0.0.202622 allows an unprivileged process to cause the profiler to open a nonregular mapping file, such as a FIFO, and block indefinitely, preventing further ELF analysis and causing a denial of service.

matrix-sdk-crypto starting in version 0.12.0 and prior to version 0.17.0 was missing a check for the user ID when decrypting an Olm-encrypted event containing the sender_device_keys property. This could be exploited to forge an encrypted to-device event, but only if the attacker colludes with the homeserver operator.

OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specifically, the startHl7ArchiveMigration method is accessible, which should be restricted to admin-level accounts.

Concrete CMS below 9.5.3 is vulnerable to stored XSS via the Date Format field in the Page Attribute Display block. A user with edit_page_contents permissions could store a payload that executes in the browser of any visitor viewing a page where the block displays a date-type attribute.

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block. A user with permission to edit file properties could store a script payload that executes in the browser of any visitor to a page displaying the block with the description or tags column enabled, including unauthenticated visitors.

Concrete CMS 9.5.2 and below is vulnerable to CSRF in the Express "Clear Entries" function (POST /index.php/dashboard/system/express/entities/delete_entries) because the controller records but does not enforce a failed CSRF token check. A remote unauthenticated attacker can force an authenticated administrator visiting an attacker-controlled page to permanently delete all entries of an attacker-selected Express entity.

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate() method on submitted data, which for file-referencing blocks (e.g., hero_image, gallery) is where the referenced file is authorized against the user's file-manager visibility. This allowed an authenticated user with block-add scope to store and render a reference to a file that would otherwise be rejected, disclosing its URL and preview.

Apko and melange verified only the control section hash (e.g. .PKGINFO) against the signed APKINDEX, but never verified the data section hash, i.e. the actual package files. An attacker able to compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed.

In Shelf, authenticated users with the asset:import permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The imageUrl validation can be bypassed via image-extension suffixes, image-related path keywords, domain substring matching, and redirect chains, resulting in a Server-Side Request Forgery (SSRF) vulnerability. Additionally, response bodies are fully buffered before size validation, creating a memory exhaustion vector.