CVE Vulnerability Catalog

Concrete CMS 9 through 9.5.2 did not validate an anti-CSRF token in the Boards custom slot dialog controller (concrete/controllers/dialog/board/custom_slot.php) saveTemplate() action. The action created a board_slot_proxy Block and dispatched an AddCustomSlotToBoardCommand against a board instance while gating only on the per-resource canEditBoardContents() permission, so a crafted cross-site request could cause a user holding board-edit permission with an active session to write attacker-chosen slot and template data to a board under their own authority. The state-changing database write completed before any downstream rendering, so the forged request succeeded even when the HTTP response returned a non-200 status.

IBM WebSphere Application Server 9.0 and 8.5 is vulnerable to a denial of service caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to trigger excessive resource consumption, potentially leading to reduced availability of the affected service.

IBM WebSphere Application Server 9.0 and 8.5 is vulnerable to a denial of service caused by sending a specially-crafted HTTP request to an administrative endpoint. A remote attacker could exploit this vulnerability to cause the server to exhaust filesystem space.

A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent (SSM Agent) before 3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote destination denylist and reach link-local endpoints.

Angular before 20.3.30, 21.2.22, and 22.1.4 has a server-side rendering (SSR) vulnerability in @angular/platform-server. Serialization of untrusted input inside fallback raw-content elements (noscript, iframe, noembed, noframes) fails to escape matching closing tags, enabling arbitrary JavaScript execution.

In Angular prior to 20.3.28, 21.2.20, and 22.1.1, @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the child still stores the private response in TransferState serialized as JSON in the ng-state script. A later unauthenticated or unauthorized visitor can receive the cached HTML containing the earlier authenticated user's sensitive response data.

Angular before 20.3.30, 21.2.22, and 22.1.4 has a server-side rendering (SSR) vulnerability in @angular/platform-server. Serialization of ProcessingInstruction DOM nodes inside fallback raw-content elements fails to escape matching ancestor closing tags, allowing premature container termination and arbitrary JavaScript execution.

In Angular prior to 20.3.28, 21.2.20, and 22.1.0, the compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-sensitive directive host bindings because SecurityContext was derived from the declaring directive or component selector rather than the concrete host element. The mismatch is reachable through hostDirectives composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic directives, SVG/MathML namespace elements, and tag-neutral selectors such as :not(...). Attacker-controlled href, src, action, xlink:href, or data values can therefore reach DOM attributes without Angular's built-in sanitizer and execute arbitrary JavaScript in the user's browser context.

Angular before 20.3.30, 21.2.22, and 22.1.4 has a server-side rendering (SSR) vulnerability in @angular/platform-server. The resolveUrl and parseUrl utilities call String.prototype.trim(), which removes leading Unicode whitespace after a same-origin check, converting a relative path into an attacker-controlled protocol-relative URL, leading to SSRF and credential disclosure.

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver causes a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal identifier. An authenticated user who can influence the identifier may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed.

A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authentication backend is present and a connection configured to use it.

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver causes a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal identifier. An authenticated user who can influence the identifier may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed.

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver causes a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal identifier. An authenticated user who can influence the identifier may obtain stored file content beyond the intended target, cause all GridFS file chunks in the affected bucket to be removed, or rename a stored file other than the intended target.

A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the hosting application process to terminate. Reaching the issue requires an affected reactive encryption configuration that retrieves KMS credentials on demand.

Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh. When building Envoy RBAC rules to enforce Connect intentions, Consul did not correctly escape certain characters in service names, namespaces, and partitions, causing the generated authorization rules to match more broadly than intended.

The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events.

Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-imported catalog objects. A caller with {{service:write}} or {{node:write}} permission may exploit this issue to remove services, checks, or nodes imported from a peered cluster without holding authority over the peer origin.

Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory before ACL authorization is evaluated. A client that can complete the internal RPC mTLS handshake may exploit this issue without holding a valid ACL token.

Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path. An authenticated attacker with a token granting node-write permission on any single node name may delete another node's catalog registration and take over its node identity if they can obtain its node ID.

Concrete CMS versions 8.3.0 through 9.5.2 contain an authorization bypass in the Calendar event edit dialog. Permissions were checked against the calendar identifier supplied in the request rather than the calendar owning the targeted event, allowing a user with "Add Event" permission on one calendar to read and overwrite events on calendars they were not permitted to access.