CVE Vulnerability Catalog

In Lychee before 7.7.1, the POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array that is merged after server-computed purchase parameters. An unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before passing to an Omnipay gateway, allowing underpayment and acquisition of goods.

In Lychee before 7.7.0, ImageMagick PDF support with Ghostscript does not apply an effective pre-render limit to PDF page dimensions in ImagickHandler::loadPdf(). An authenticated user can upload a small PDF with an oversized /MediaBox, causing significant CPU consumption and clogging the image-processing queue.

In Lychee before 7.7.0, the hidden Omnipay Dummy test provider can be used by a buyer (including a guest) by submitting it directly, as CreateSessionRequest does not enforce OmnipayProviderType::isAllowed(). This allows completing the test gateway flow without a real payment and releasing the purchasable item if auto-fulfillment is enabled.

In Lychee before 7.6.4, SecurePathController serving GET /image/{path} concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under a specific non-default configuration, any authenticated user can read files outside the intended directory, including application configuration and other users' private images.

In Lychee before 7.6.3, the GET /api/v2/Zip endpoint authorizes album and photo archives through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first enforcing AlbumPolicy::canAccess(). For a public, password-protected album with grants_download enabled, an unauthenticated attacker who knows the album identifier can download a ZIP archive without supplying the password.

In Lychee before 7.6.1, the POST /api/v2/Album::unlock endpoint has no throttle, attempt counter, backoff, CAPTCHA, or lockout. A remote unauthenticated attacker who knows the album identifier can automate password guesses against a password-protected album and gain access to its private photo collection.

The XStore plugin for WordPress contains a Reflected XSS vulnerability caused by improper neutralization of input during web page generation. The issue affects versions prior to 9.7.9.

OpenNext Cloudflare, a Next.js adapter for Cloudflare, in versions from 0.3.0 until 1.20.2 mishandles encoded pathnames when cache interception is enabled and access control relies on middleware. An unauthenticated attacker can retrieve cached protected content using a percent-encoded pathname that does not match authorization middleware but decodes to the cache key of a protected route.

kin-openapi, a Go project for handling OpenAPI files, prior to 0.149.0 lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema during runtime request and response validation. This causes unbounded recursion and a fatal stack overflow that terminates the entire process and cannot be caught with recover.

kin-openapi, a Go project for handling OpenAPI files, in versions from 0.136.0 until 0.149.0 lacks a nil-items guard for legal OpenAPI 3.1 array schemas in three openapi3filter decoder paths. An unauthenticated remote client can trigger a deterministic nil-pointer panic via an array query parameter, a deepObject query parameter, or an application/x-www-form-urlencoded request body.

Sonatype Nexus Repository 3 allows a user holding the role create or role update permission to grant roles and privileges that the account does not hold. This can lead to privilege escalation up to full administrative access.

Nexus Repository 3 lacks an authorization check in the NuGet Components API upload path, allowing an account with only repository read and browse privileges to upload NuGet symbol packages (.snupkg). Exploitation requires a hosted NuGet repository with Symbol Server enabled, and with anonymous access enabled this precondition is met by default.

kin-openapi, a Go project for handling OpenAPI files, in versions from 0.136.0 until 0.143.0 accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding requests and responses. A remote unauthenticated client can deterministically trigger a nil-pointer panic during ValidateRequest or ValidateResponse.

FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue.

Ansible Operator Plugins contains a Jinja2 template injection vulnerability. A low-privileged Kubernetes user can craft malicious custom resource (CR) specification values that are processed by Ansible without proper sanitization, leading to code execution in the operator pod.

OPNsense, a FreeBSD-based firewall and routing platform, prior to 26.1.11 mishandles privilege values in ACL::hasPrivilege(). A user directly assigned both a component write privilege and user-config-readonly can be treated as lacking the read-only restriction, allowing MVC APIs to persist configuration changes.

OPNsense, a FreeBSD-based firewall and routing platform, prior to 26.1.11 allows carriage-return and line-feed characters in the WebGUI login username field. An attacker with network access to the login page can forge authentication events for another IP, adding it to the sshlockout PF table, or reset their own brute-force counter.

In OPNsense before version 26.1.11, the OpenVPN dashboard widget and connection-status view place a client common_name into data-common-name attributes without quote-safe encoding. With username-as-common-name and RADIUS or LDAP authentication, an attacker can inject an event handler and execute script in an administrator's session. Fixed in version 26.1.11.

In OPNsense before version 26.1.10, the Trust module stores attacker-controlled refid values and interpolates them into XPath expressions, allowing a user with CA Manager or Certificate Manager privileges to recover values from config.xml character by character via a boolean refcount oracle. Fixed in version 26.1.10.

Unitronics UniStream Pro (B10/C10) with UniLogic before version 1.41.329 contains a use of externally-controlled format string vulnerability. This may lead to unexpected behavior or code execution.