CVE Vulnerability Catalog

The Velociraptor verify() VQL function allows a user to verify an artifact for syntactic and other issues. Due to an implementation fault, the global artifact repository is used, allowing callers to overwrite existing artifacts without the required permissions. The attacker only needs NOTEBOOK_EDIT permission (e.g., an analyst role) to call this function.

A vulnerability was determined in jQWidgets up to 24.0.1 in the JQXLite.extend and jqxBaseFramework.extend functions of the file jqwidgets/jqx-all.js. This manipulation causes improperly controlled modification of object prototype attributes. The attack can be initiated remotely.

A vulnerability was found in TanStack devtools-vite 0.7.0 in the installPackage function of packages/devtools-bundler-core/src/package-manager.ts of the Development Devtools Event Bus component. Manipulation of the packageName argument results in OS command injection. The attack requires local access and is difficult to exploit, but the exploit has been made public.

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0 in an unknown functionality of the file /pages/processlogin.php. Manipulation of the User argument leads to SQL injection. The attack can be initiated remotely and the exploit has been disclosed publicly.

A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306 in the strcpy function of the file /goform/formConfigFastDirectionW. Manipulating the ssid argument can lead to buffer overflow. The attack may be performed remotely and the exploit has been published.

A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. It affects the strcpy function in the file /goform/aspRemoteApConfTempSend of the HTTP Request Handler component. Manipulating the Profile argument results in a stack-based buffer overflow. The attack can be carried out remotely, and the exploit is public.

A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. It affects the httpcon_check_session_url function of the Session Validation Handler component. This manipulation leads to improper authentication. The attack can be executed remotely, and the exploit is public. The vendor did not respond.

A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the httpcon_check_session_url function of the Session Validation Handler component. This manipulation causes improper authentication. Remote exploitation is possible, and the exploit is public. The vendor did not respond.

A security flaw was discovered in provectus kafka-ui up to 0.7.2 in the executeSmartFilterTest function of kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java of the Groovy Code Handler component. The manipulation results in code injection. The attack can be launched remotely, and the exploit has been released.

The exceljs library through version 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions.

The exceljs library through version 4.4.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook.

The exceljs library through version 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious __proto__ property to cell notes, modifying Object.prototype and affecting all plain objects created in the process.

The exceljs library through version 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of service.

In BentoML, the outbound connection safeguard (make_safe_connect in _internal/utils/uri.py) blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space (100.64.0.0/10, CGNAT). In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs pointing to that range via multipart file handling (MultipartSerde.ensure_file) or JSON request parsing (JSONSerde.parse_request), causing the server to make outbound requests to internal hosts on CGNAT networks (Server-Side Request Forgery). This is an incomplete fix for CVE-2025-54381.

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.test_func returns only request.user.is_active unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored lint results provides an override, so each resolves a ReportTemplate from a caller-supplied primary key with no ownership or client-scope check. Any authenticated account can therefore lint an arbitrary template, which overwrites that template's stored lint result, and can read the returned findings, which enumerate the template's variable names and template-engine errors and so disclose its structure. This is distinct from the template swap path: that endpoint authorizes the report but omits the per-template check, whereas these endpoints omit authorization entirely and remain unfixed.

Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then generate reports to disclose template contents including letterhead, boilerplate, and methodology text.

A vulnerability was found in libwebsockets 4.5.0 in the report_raw_cbor function of lib/misc/lecp.c in the LECP CBOR Recording component. Manipulation leads to an out-of-bounds write. The attack can be launched remotely, and the exploit is public.

A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3 in the unknown processing of the file /user/note.php of the User Notes Handler component. Manipulation of the ID argument leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 23.0.4 and 24.0.0 addresses this issue.

A flaw has been found in Open5GS 2.8.0 in the unknown code of the AMF UEContextReleaseRequest Path Handler component. Executing a manipulation can lead to improper authorization. The attack can be launched remotely.

A vulnerability was detected in Open5GS 2.8.0 in the pcrf_rx_aar_cb function of src/pcrf/pcrf-rx-path.c in the Rx AA-Request Handler component. Manipulation leads to an out-of-bounds read. The attack can be initiated remotely.