CVE Vulnerability Catalog

FiftyOne prior to 1.17.0 has a vulnerability where the App/API server and the /media route unconditionally return Access-Control-Allow-Origin: *. Because the embedded server is local and unauthenticated, a malicious website visited by the user can read cross-origin responses. The /media endpoint accepts a filesystem path, allowing a drive-by page to read files accessible to the server process and exfiltrate them without additional clicks.

KEDA prior to 2.20.0 has a vulnerability in constructing libpq-style connection strings from tenant-controlled values (host, port, userName, dbName, sslmode, password). escapePostgreConnectionParameter() only quotes values containing a literal space, so tabs, newlines, carriage returns, form feeds, vertical tabs, quotes, and backslashes can create additional key-value tokens when pgx parses the string. An attacker able to create or modify a TriggerAuthentication or ScaledObject can inject host or sslmode parameters, redirect the database connection to an attacker-controlled server, expose credentials, or disable intended TLS protection.

LibVNCClient, a library for easy implementation of a VNC client, in versions 0.9.12 through 0.9.15, contains a vulnerability that allows a malicious (or man-in-the-middle) VNC server to force a connecting libvncclient to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with attacker-controlled length, contents, and offset. It requires no authentication, works in a default build, and can crash the client or lead to code execution. The issue is patched in commit 540332be3e0acc566fa64da6f1b4680c72c724dd.

Picotls is a TLS protocol library that allows users to select different crypto backends. Prior to commit c14231d801407640bc42c2dcf92783409ea6a7c7, the ASN.1 validator recursively descends into constructed ASN.1 elements without enforcing a maximum nesting depth. If an application loads an attacker-supplied private-key file through ptls_minicrypto_load_private_key(), or otherwise calls the public ASN.1 validation API on untrusted DER, a crafted deeply nested ASN.1 structure can exhaust the process stack and crash the application.

Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean() in internal/util/file.go. A malicious or compromised external module can place absolute or traversal paths in the manifest, causing cleanup to delete files outside the module cache that are accessible to the Terragrunt process before OpenTofu or Terraform executes.

Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left by a partially extracted tar archive. A malicious server supplying a Git repository or tar archive can cause files outside the build context directory to be included in the context or copied into the build.

Combodo iTop, a web based IT service management tool, prior to version 3.2.3, contains a Reflected Cross-Site Scripting (XSS) vulnerability in the universal search. This issue has been fixed in version 3.2.3.

Combodo iTop, a web based IT service management tool, prior to version 3.2.3, contains a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3.

Combodo iTop, a web based IT service management tool, prior to version 3.2.3, contains a Reflected Cross-Site Scripting (XSS) vulnerability in the synchro import script. This issue has been fixed in version 3.2.3.

Combodo iTop, a web based IT service management tool, prior to version 3.2.3, contains a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3.

Combodo iTop is a web-based IT service management tool. Prior to version 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3.

In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later.

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record ID to retrieve decrypted SMTP passwords, email API keys, and email API secrets due to the read policy using an always-allow authorization check that bypasses all identity verification.

Joomla extension J2Store (versions 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5) is vulnerable to Stored Cross-Site Scripting (XSS) through the guest checkout billing address fields. An unauthenticated attacker exploits a filter bypass in Joomla's Input::getArray() combined with PHP's variables_order=EGPCS (Cookie overrides POST in $_REQUEST) to store unsanitized HTML in fields such as billing_first_name.

Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domain. No authentication required.

Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted the upload and invoices directories, causing fresh installs to deploy those directories without .htaccess/web.config protection, making uploaded files directly web-accessible.

Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another customer's order_id to copy their cart contents and address data into the attacker's session. The CSRF token was validated but ownership was not checked.

Joomla extension J2Store (versions 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5) allows an unauthenticated visitor to supply any order_id as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals.

Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order token could increment the download limit counter on a download record belonging to a different order. The endpoint also lacked a CSRF token.

Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file() in bundle-uri.c during clone or fetch when transfer.bundleuri=true. Non-HTTP(S) values are treated as local filesystem paths, and file URI prefixes are removed, so a bare UNC path or file URI targeting an attacker-controlled share causes Windows to initiate an outbound SMB connection. This can expose NTLM authentication material to the attacker-selected host. This issue is fixed in version 2.55.0.windows.4.