CVE Vulnerability Catalog

XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redirect URI binding by submitting a different allowlisted URI than the one recorded at authorization time.

XenForo before version 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint. An unauthenticated attacker can obtain valid token pairs by submitting empty values for client_secret and code_verifier parameters, exploiting PHP truthy evaluation logic that treats empty strings as false and skips client secret and PKCE validation.

A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials, and any operation performed by the victim is attributed to the attacker's account.

An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web management interface and modify the Smart Polling discovery configuration.

An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality. Encrypted connections to target devices were established without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker can impersonate the device during a polling session and intercept communication, including credentials.

An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of entries. Actual credential values are not directly visible, but the user can delete entries or edit their properties.

A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a malicious dashboard.

x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen (if needed) when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbed page.

A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.

Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers should upgrade to the resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.

CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers should upgrade to the resolved maintenance release. Update CommServe and Web Server.

CommServe contained a path traversal issue affecting information disclosure. Software customers should upgrade to the resolved maintenance release. Update CommServe.

CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers should upgrade to the resolved maintenance release. Update CommServe.

CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers should upgrade to the resolved maintenance release. Update CommServe.

CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers should upgrade to the resolved maintenance release. Update CommServe.

Private Metrics Server contained an SQL injection condition affecting database operations. Software customers should upgrade to the resolved maintenance release. Update Private Metrics Server.

Private Metrics Server has a missing authentication condition affecting metrics upload functionality and service availability. Software customers should upgrade to the resolved maintenance release.

Content Extractor has a deserialization of untrusted data issue affecting privilege management. Software customers should upgrade to the resolved maintenance release.

DataCube has a path traversal issue affecting security feature enforcement. Software customers should upgrade Content Extractor and Index Store.

Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Command Center.