CVE Vulnerability Catalog

react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. Attackers who can influence URL-type backend fields can execute JavaScript in an administrator's authenticated session when the administrator clicks the rendered link.

OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user's events, including non-public ones restricted to their owner.

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeEEOReport and generateEEOReportPreview actions to view aggregate ethnicity, veteran, gender and disability statistics.

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest() that allows low-privileged authenticated users to roll back data imports. Attackers with READ-level access can request the import module's revert action with an importID to mass-delete imported candidate, company, and contact records.

OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editListName.php, deleteList.php, or addToLists.php with any savedListID to alter or delete any saved list site-wide.

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the configured SMTP relay. Read-level users can supply testEmailAddress and fromAddress parameters to send the fixed test message to any recipient with a spoofed From address.

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary activityID via GET or POST to modify or delete activity and pipeline history for candidates, contacts and companies.

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service.

PIA's token verification (verify_token in pia/oidc.py) fetches the OIDC discovery document of an allowlisted issuer and then follows the jwks_uri contained in that response without parsing it as a URL, comparing it against the approved issuer's origin, or requiring HTTPS. An approved identity provider can therefore direct PIA to issue a GET request to an arbitrary host and port, including over plaintext http, from PIA's own network position, before any signature is verified.

A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices.

A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data.

The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content; this requires a page containing the shop's order plugin. Orders that are already paid are not affected.

Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient.

A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0 in an unknown function of the file src/index.ts of the Advanced Search Tool component. Manipulation of the fileType argument results in OS command injection; the attack requires a local approach. The exploit has been released publicly and the real existence of this vulnerability is still doubted.

The download link for files uploaded through a form relied on a predictable token, and the file name in the request was not verified in a guess-resistant way. An unauthenticated attacker could access files uploaded by other visitors; the token was also shown in plain text in the text version of the notification email.

The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check protecting the other methods, so the fetched URL is fully controlled by the requester. An unauthenticated attacker can make the server send requests to arbitrary internal or external hosts and receives the status code and selected response headers, enabling probing of internal hosts and ports; response bodies are not disclosed.

The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders still awaiting payment to "canceled"; this requires a page containing the shop's order plugin. Orders that are already paid are not affected.

The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.

The extension no longer applied its access protection to files in file storages using a non-default relative base path. These files were served directly by the web server without authentication or permission checks. The issue is only exploitable when the extension is used on a website running TYPO3 14.3.

The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.