CVE Vulnerability Catalog

This CVE candidate has been rejected. Do not use this candidate number. All references and descriptions have been removed to prevent accidental usage.

A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptions of the file internal/events/webhooks/webhooks.go of the component Webhook Subscription. Performing a manipulation of the argument url results in server-side request forgery. Remote exploitation is possible, and the exploit is public.

A path traversal vulnerability was detected in Dokploy up to version 0.29.7, affecting the writeTraefikConfigInPath function in the file packages/server/src/utils/traefik/application.ts of the Settings component, through manipulation of the path argument. The attack can be launched remotely, and the exploit is public.

A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects the function flow_update_cart of the file /flow.php?step=update_cart. The manipulation of the argument rec_id leads to sql injection. The attack can be initiated remotely, and the exploit is public.

A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function check_img_type of the file admin/pack.php. Executing a manipulation of the argument pack_img can lead to unrestricted upload. It is possible to launch the attack remotely, and the exploit is public.

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint to retrieve plaintext super-admin JWT tokens for full platform control.

pypdf prior to 6.15.0 has a vulnerability causing long runtimes when the function read_until_whitespace in pypdf/_utils.py reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes concatenation in a one-byte loop, causing quadratic processing cost.

Tornado before version 6.5.8 does not limit the number of fields when parsing application/x-www-form-urlencoded request bodies. An unauthenticated request with millions of fields can stall the single-threaded event loop and delay every connection.

Sulu, a PHP content management system, before versions 2.6.25 and 3.0.8 allows an attacker with media upload permission to store HTML, XHTML, or XML documents and create links with inline=1, causing the application to return the file without Content-Disposition attachment. Opening such a link by an authenticated user allows execution of malicious JavaScript in the context of the victim's session on the Sulu origin.

Sulu before versions 2.6.25 and 3.0.8 has a vulnerability in the media move endpoint where the permission check is based on the client-supplied collection value rather than the actual source collection. An authenticated backend user with edit permission in one collection can move an item out of a restricted collection and then view or download content they are not permitted to access.

Sulu before versions 2.6.25 and 3.0.8 does not enforce VIEW permission for target resources in the preview-link endpoint. An authenticated administrative user who knows a resource identifier can create or revoke a preview link for any page, article, or snippet, including content they cannot view. The generated preview URL is public and allows reading restricted content without authentication.

pnpm before versions 10.34.5 and 11.11.0 accepts a scoped path traversal in the package name in a tarball dependency's package.json manifest. During installation, this can lead to package extraction outside node_modules and overwriting arbitrary filesystem paths, even when --ignore-scripts is used.

Wallos before version 5.0.0 allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. An attacker can break out of the current VEVENT block and insert attacker-controlled calendar events, including spoofed organizers and email addresses, into any calendar application subscribed to that feed.

Wallos from version 2.0.0 to before 5.0.0 allows any authenticated user (no admin rights required) to make the server open arbitrary outbound SMTP connections to internal/link-local addresses by setting the SMTP host of their personal email notifications to an internal IP. Lack of SSRF validation in the notification settings endpoint and the notification cron leads to connections to the chosen host:port.

Wallos prior to version 5.0.0 allows any authenticated user to store an arbitrary SMTP host (including private and cloud-metadata IP addresses) in their email notification settings, with no server-side SSRF validation. When the scheduled notification cron job runs, it passes the stored host directly to PHPMailer, causing the Wallos server to open an outbound TCP connection to the specified address. This gives a low-privileged attacker a reliable mechanism to probe internal network services from the server's perspective. This issue has been patched in version 5.0.0.

Wallos before version 5.0.0 ships a second, near-identical, unauthenticated logo-image search endpoint (endpoints/payments/search.php) that was not hardened against SSRF. It passes the HTTP_PROXY/HTTPS_PROXY environment variable straight into CURLOPT_PROXY.

A flaw was found in WebKitGTK where processing malicious web content can cause memory corruption due to improper memory handling.

In cu silicon up to version 0.1.5, a missing authentication vulnerability was identified in the create_app function of views.py in the edit Endpoint component. The attack can be performed remotely, and the exploit is publicly available.

In kishan0725 Hospital-Management-System 1.0, a SQL injection vulnerability was discovered in /search.php via manipulation of the Contact argument. The attack can be launched remotely, and the exploit has been released publicly.

A vulnerability was found in QuantumNous new-api up to version 1.0.0-rc.15 in the file /api/usage/token/ of the Revoked API Token Handler component. Manipulation leads to session expiration. The attack can be performed remotely, and the exploit has been publicly disclosed. Upgrading to version 1.0.0-rc.17 resolves the issue.