CVE Vulnerability Catalog

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2. An authenticated attacker could bypass access control restrictions and view GitLab Pages content intended only for project members by authenticating through OAuth providers.

GitLab EE versions from 17.8 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 contain a flaw that could allow an authenticated attacker to leak sensitive information from confidential issues by injecting hidden prompts into merge request comments.

GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.4, and 18.5 before 18.5.2. An authenticated user could gain CSRF tokens by exploiting improper input validation in repository references combined with redirect handling weaknesses.

A weakness was identified in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution up to 4.0. It impacts an unknown function of the file /dashboard/Ccustomer/manage_customer. Manipulation of the Search argument causes cross site scripting. The attack may be initiated remotely and the exploit is publicly available.

h3blog 1.0 by pojoin has a cross-site scripting (XSS) vulnerability in /admin/cms/category/addtitle. Manipulation of the Title argument leads to XSS. The attack can be performed remotely, and the exploit is publicly available.

h3blog 1.0 by pojoin has a cross-site scripting (XSS) vulnerability in /admin/cms/material/add. Manipulation of the Name argument leads to XSS. The attack can be performed remotely, and the exploit has been publicly disclosed.

A vulnerability was found in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System up to 20250320 affecting an unknown function of the file /edit_profile. Manipulation of the first_name/last_name arguments results in basic cross-site scripting; the attack can be initiated remotely and the exploit has been made public. The vendor did not respond to the disclosure.

A cross-site scripting vulnerability was found in SalesERP (Bdtask/CodeCanyon) up to version 20250728, affecting the /edit_profile file in the User Profile Handler component. Manipulation of the first_name/last_name arguments allows script injection. The attack can be carried out remotely and a public exploit is available.

An insufficient policy enforcement vulnerability in Palo Alto Networks Prisma® Browser on Windows allows a locally authenticated non-admin user to bypass the screenshot control feature of the browser. Browser self-protection should be enabled to mitigate this issue.

An insufficient validation of an untrusted input vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admin user to revert the browser’s security controls.

Mattermost versions <11.0 fail to properly enforce the "Allow users to view archived channels" setting, allowing regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads.

Jitsi Meet versions prior to 2.0.10532 contain a vulnerability that allows hijacking the OAuth authentication window for Microsoft accounts. This is fixed in version 2.0.10532. No known workarounds are available.

A Reflected Cross-Site Scripting (XSS) vulnerability exists in Astro's development server error pages when the `trailingSlash` configuration option is used. An attacker can inject arbitrary JavaScript that executes in the victim's browser context via a crafted URL. The issue only affects the development server, not production builds, and is fixed in version 5.15.6.

OpenObserve versions up to and including 0.16.1 render HTML markup in organization names inside the invitation email template, indicating user-controlled input is inserted without proper HTML escaping. As of publication, no patched versions are available.

Dell Alienware Command Center 6.x (AWCC) versions prior to 6.10.15.0 contain a Process Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.

Mattermost versions 10.11.x <= 10.11.3 and 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API. This allows users from one team to access user metadata and channel membership information from other teams via the API endpoint.

Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to cause denial of service against other CREATE STATISTICS users by creating an object in any schema. A later CREATE STATISTICS for the same name by a user with CREATE privilege would fail. Affects versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23.

A self-XSS vulnerability in PrivateBin allows a filename containing HTML to be reflected verbatim into the page via the drag-and-drop helper. A macOS or Linux user who drags a crafted file into the editor executes arbitrary JavaScript within their own session. File upload must be enabled and user interaction is required.

In Wasmtime, a WebAssembly runtime, versions prior to 38.0.4, 37.0.3, 36.0.3, and 24.0.5 contain an unsound interaction in the Rust embedder API. A WebAssembly shared linear memory could be viewed as a type providing safe host access to its contents, leading to a data race in the host when modified in parallel.

In sudo-rs (a memory-safe sudo and su implementation in Rust) versions 0.2.7 prior to 0.2.10, if a user begins entering a password but does not press return for an extended period, a password timeout may occur and the entered keystrokes are echoed back to the console. This could reveal partial password information, potentially exposing history files and enabling social engineering or pass-by attacks. Version 0.2.10 fixes the issue.