CVE Vulnerability Catalog

Prior to 4.33.0, viewRole is not applied to anonymous visitors when a developer exposes user objects through a publicly rendered relationship or expressly enabled public API. Inadequately limited templates, including serialization of an entire related user object, can conditionally disclose user fields, but password hashes are stored separately and are not affected.

From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer() builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string.

In sanitize-html 2.18.0, when an <iframe> is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options). The recursion has no bound and starts each nested call with a fresh state.

Prior to 3.7.1 of the import-export module and 4.34.0 of core ApostropheCMS, an editor who can import an enabled content type but lacks its stronger publication role can cause import write helpers to create, replace, or remove published variants without the normal publish permission and lifecycle checks.

In aaPanel up to 8.25.0, the send_file function in BTPanel/routes/v2.py of the Download Endpoint component allows manipulation of the filename argument leading to path traversal. The attack can be executed remotely, the exploit has been published and may be used, and the vendor confirms the reported RCE and LFI vulnerabilities require authentication.

Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the style attribute and inject executable attributes when published content, or an affected draft viewed by a higher-privileged user, is rendered.

ApostropheCMS prior to 4.34.0 has a getOne REST endpoint for pages that does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document _id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces both restrictions.

In ThreadX, the module manager's thread-delete dispatcher released only the first of two allocations (the TX_THREAD control block and the TXM_MODULE_KERNEL_STACK_SIZE kernel stack). The kernel stack stayed allocated until the whole module was stopped, so a module creating and deleting threads in a loop exhausted the shared object pool, preventing creation of new kernel objects and module threads system-wide.

The block-pool create dispatcher in the ThreadX module manager validated only two ALIGN_TYPE words of the extra-parameter array supplied by a memory-protected module, then used indices 0 through 3. One unvalidated word is read by the dispatcher's own range check (index 1 as pool start, index 2 as length), so the out-of-bounds read is performed by the validation code before reaching the kernel service.

In the ThreadX module manager, object lookup validated only one byte of a memory-protected module's search name, then walked it in privileged mode with preemption raised. txm_module_object_pointer_get_extended is given a length but does not use it to bound the buffer, and the deprecated txm_module_object_pointer_get supplies the maximum UINT value, removing the bound.

The ThreadX module manager's dispatch layer, when reaching a kernel object's delete service, only checked whether the pointer lay outside the module's own code and data — the policy for using an object, not destroying it. A module could name any object it had a pointer to (including objects created by the application or other modules) and have the privileged dispatcher delete it.

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is reported to the server as though it were a header, letting a client control request framing decisions it should not reach.

_gx_multi_line_text_view_display_info_get() reads one byte past the end of the application's text buffer when the given string ends with a carriage return (\r). The over-read can also cause callers to advance their index past the end of the string, producing a second over-read in _gx_multi_line_text_view_string_total_rows_compute() and a row of text not present in the source.

VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability allowing remote attackers to inject script via unencoded filename1/filename2 parameters in similarity/diff.php. Attackers can craft a diff.php link with a JavaScript payload that runs when a user holding mod/vpl:similarity opens it.

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. A crafted Cineon file with a huge declared width wraps the size calculation to zero, so UnPackPacked reads past a 4-byte buffer and crashes the application.

HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. A crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths crashes any application that shapes text with the font.

Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attackers can bypass the web UI restriction to remove domains, orphan vhost, DNS and subdomain records, and drive subdomains_used below zero to gain extra subdomain allowance.

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists, resource limits, notes, and login history.

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition variants of publicly shared foods, destroying victims' data.

Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving full document bodies, including Markdown and Yjs data, via DeliverWebhookTask for every matching workspace event.