CVE Vulnerability Catalog

In Piwigo prior to version 16.3.0, the pwg.history.search API method is registered without the admin_only option, allowing unauthenticated users to access the full browsing history of all gallery visitors.

A vulnerability in Hirschmann HiLCOS Classic Platform switches exposes user passwords synchronized with SNMPv1/v2 community strings transmitted in plaintext. Attackers with local network access can sniff SNMP traffic or extract configuration data to recover plaintext credentials and gain unauthorized administrative access.

Hirschmann HiLCOS devices (OpenBAT, WLC, BAT300, BAT54) before version 8.80 and OpenBAT before 9.10 are shipped with identical default SSH and SSL keys that cannot be changed. This allows unauthenticated remote attackers to decrypt or intercept encrypted management communications.

OS command injection in the browser-based authentication component in Amazon Athena ODBC driver before 2.0.5.1 on Linux might allow a threat actor to execute arbitrary code by using specially crafted connection parameters that are loaded by the driver during a local user-initiated connection.

Allocation of resources without limits in the parsing components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat actor to cause a denial of service by delivering crafted input that triggers excessive resource consumption during the driver's parsing operations.

Insufficient authentication security controls in the browser-based authentication components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat actor to intercept or hijack authentication sessions due to insufficient protections in the browser-based authentication flows.

Improper certificate validation in the identity provider connection components in Amazon Athena ODBC driver before 2.1.0.0 might allow a man-in-the-middle threat actor to intercept authentication credentials due to insufficient default transport security when connecting to identity providers. This only applies to connections with external identity providers and does not apply to connections with Athena.

The Amazon Athena ODBC driver before version 2.1.0.0 improperly neutralizes special elements in its authentication components. This may allow a threat actor to execute arbitrary code or redirect authentication flows using specially crafted connection parameters processed by the driver during user-initiated authentication.

A specific administrative endpoint is accessible without proper authentication, exposing device management functions. Lack of access control allows unauthorized users to access sensitive operations.

prompts.chat prior to commit 1464475 contains an identity confusion vulnerability due to inconsistent case-sensitive and case-insensitive handling of usernames across write and read paths, allowing attackers to create case-variant usernames that bypass uniqueness checks. Attackers can exploit non-deterministic username resolution to impersonate victim accounts, replace profile content on canonical URLs, and inject attacker-controlled metadata and content across the platform.

prompts.chat prior to commit 30a8f04 has a server-side request forgery (SSRF) vulnerability in the Fal.ai media status polling feature. Authenticated users can perform arbitrary outbound requests by supplying attacker-controlled URLs in the token parameter, leading to disclosure of the FAL_API_KEY in the Authorization header.

In prompts.chat prior to commit 7b81836, missing isPrivate checks across API endpoints and page metadata generation allow unauthorized users to access sensitive data associated with private prompts, including version history, change requests, examples, current content, and metadata (titles, descriptions).

prompts.chat prior to commit 0f8d4c3 contains a path traversal vulnerability in skill file handling. Attackers can write arbitrary files to the client system by crafting malicious ZIP archives with unsanitized filenames containing path traversal sequences (../).

Storage credentials are hardcoded in the mobile app and device firmware. These credentials do not adequately limit end user permissions and do not expire within a reasonable amount of time. This vulnerability may grant unauthorized access to production storage containers.

Hirschmann Industrial HiVision versions 08.1.03 prior to 08.1.04 and 08.2.00 contain a vulnerability in the execution of user-configured external applications. A local attacker can place a malicious binary in the execution path, leading to arbitrary code execution with elevated privileges.

Hirschmann HiOS devices before versions 08.1.00 and 07.1.01 contain a denial of service vulnerability in the EtherNet/IP stack where improper handling of packet length fields allows remote attackers to crash or hang the device by sending specially crafted UDP EtherNet/IP packets with a length value larger than the actual packet size.

Vulnerability in Cloudreve (self-hosted file management and sharing system) before version 4.13.0. The application uses a weak PRNG (math/rand) seeded with admin account creation time. An attacker can recover the secret_key and forge JWT tokens, leading to admin account takeover.

Budibase to otwartoźródłowa platforma low-code. W wersjach przed 3.32.5, Paleta Komend Budibase renderuje nazwy encji (tabele, widoki, zapytania, automatyzacje) bez sanitizacji, co pozwala na wstrzyknięcie ładunku HTML przez uwierzytelnionego użytkownika z dostępem do Budowniczego.

Budibase before version 3.33.4 contains a path traversal vulnerability in the plugin file upload endpoint (POST /api/plugin/upload). An attacker with Global Builder privileges can upload a file with a filename containing ../, allowing deletion of arbitrary directories and writing arbitrary files to the filesystem.

In NFSD (Linux kernel), a missing reference to the network namespace (struct net) when opening /proc/fs/nfs/exports. After the namespace is torn down (e.g., container removal), reading from the open file descriptor leads to use-after-free in the export cache.