CVE Vulnerability Catalog

A vulnerability has been identified within Rancher Manager whereby `Impersonate-Extra-*` headers are being sent to an external entity, for example `amazonaws.com`, via the `/meta/proxy` Rancher endpoint. These headers may contain identifiable and/or sensitive information e.g. email addresses.

Path traversal in Canonical LXD LXD-UI versions before 6.5 and 5.21.4 on all platforms allows remote authenticated attackers to access or modify unintended resources via crafted resource names embedded in URL paths.

Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.

Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.

Information spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any container to impersonate other containers and obtain their metadata, configuration, and device information via spoofed process names in the command line.

Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration permissions to read arbitrary files on the host system via specially crafted snapshot pattern templates using the Pongo2 template engine.

A vulnerability in Viday exposes sensitive information by allowing an attacker to intercept HTTP requests and extract JWT tokens containing user data in the payload.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Download of Code Without Integrity Check vulnerability in GTONE ChangeFlow allows Path Traversal. This issue affects ChangeFlow: All versions to v9.0.1.1.

TS3 Manager is modern web interface for maintaining Teamspeak3 servers. A reflected cross-site scripting vulnerability has been identified in versions 2.2.1 and earlier. The vulnerability exists in the error handling mechanism of the login page, where malicious scripts embedded in server hostnames are executed in the victim's browser context without proper sanitization. This issue is fixed in version 2.2.2.

Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter on .within.website when Weblate is configured with Anubis and REDIRECT_DOMAINS is not set. An attacker can craft a URL on the legitimate domain that redirects a victim to an attacker-controlled site.

NVIDIA Nsight Graphics for Windows contains a vulnerability in an ngfx component, where an attacker could cause a DLL hijacking attack. A successful exploit may lead to code execution, escalation of privileges, data tampering, and denial of service.

Discourse versions 3.5.0 and below allow malicious meta-commands to be embedded in a backup dump and executed during restore. In multisite setups, this allowed an admin of one site to access data or credentials from other sites. The issue is fixed in version 3.5.1.

In Suricata version 8.0.0, rules using the keyword ldap.responses.attribute_type (which is long) with transforms can lead to a stack buffer overflow during startup or rule reload. This issue is fixed in version 8.0.1. Workaround is to disable rules with this keyword and transforms.

Discourse versions 3.5.0 and below allow authenticated users to extract information about topics they are not authorized to access by modifying the topic_id value in requests to the AI suggestion endpoints (Title, Category, Tags).

In Deciso OPNsense before 25.7.4, when creating an "Interfaces: Devices: Point-to-Point" entry, the value of the parameter ptpid is not sanitized of HTML-related characters/strings. This value is directly displayed when visiting the page/interfaces_assign.php, which can result in stored cross-site scripting. The attacker must be authenticated with at-least "Interfaces: PPPs: Edit" permission. This vulnerability has been addressed by the vendor in the product release notes as "ui: legacy_html_escape_form_data() was not escaping keys only data elements."

In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a user with a role containing the high-privilege capability `change_authentication` could send multiple LDAP bind requests to a specific internal endpoint, causing high server CPU usage and potentially a denial of service (DoS) until the Splunk Enterprise instance is restarted.

In Splunk Enterprise and Splunk Cloud Platform, a low-privilege user without the admin or power roles can perform an XML external entity (XXE) injection through the dashboard tab label field. The XXE injection can cause denial of service (DoS) attacks.

In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low-privileged user without admin or power roles could craft a malicious payload through error messages and job inspection details of a saved search. This could result in execution of unauthorized JavaScript code in a user's browser.

In Splunk Enterprise versions below 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, a low-privileged user without 'admin' or 'power' roles could craft a malicious payload through the `dataset.command` parameter of the `/app/search/table` endpoint. This could result in execution of unauthorized JavaScript code in a user's browser.

In Splunk Enterprise and Splunk Cloud Platform, a low-privileged user could access sensitive search results if they guess the unique Search ID (SID) of an administrative search job running in the background.