CVE Vulnerability Catalog

Dokploy prior to 0.29.13 contains a command injection vulnerability in cloneGitRepository. An authenticated user with application access can execute arbitrary OS commands on the Dokploy host by setting a malicious custom Git URL and triggering deployment.

CyberPanel 2.4.3 contains an authenticated command injection vulnerability in the remote backup transfer feature. Attackers can control a remote server's API response and inject malicious commands via a crafted directory name, which bypasses security middleware and is passed unsanitized to the OS command execution function.

CyberPanel 2.4.3 contains an authenticated remote code execution vulnerability in the remote backup feature. Attackers can supply a malicious remote server address, allowing them to write an attacker-controlled public key to /root/.ssh/authorized_keys, granting persistent root access to the host system.

Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering. Authenticated users can create malicious incident templates with Blade directives or Twig filters that execute system commands, achieving remote code execution as the web server process.

Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in load_checkpoint_in_model and load_checkpoint_and_dispatch functions that fail to sanitize weight_map entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read arbitrary files, or point shard entries at named pipes to cause indefinite blocking and denial of service.

Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability is fixed in Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19.20.

TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation fault. Additionally, multiple action endpoints process attacker-controlled parameters using unsafe string operations such as sprintf() and strcat() without adequate bounds checking, allowing crafted input to trigger buffer overflows and crash the web server.

TBEA TLogger V2.1.0.0B0.0.0.0 contains an unauthenticated resource exhaustion vulnerability in its web server. An unauthenticated remote attacker can send PUT requests to the /tmp/ endpoint, causing the web server to create persistent files containing attacker-controlled data under /opt/myapp/webserver/. The generated files are not removed because the web server attempts to move them into a non-existent directory. Repeated requests can therefore exhaust available storage and cause a denial-of-service condition.

Dokploy prior to 0.29.13 contains a vulnerability in the unauthenticated /api/providers/github/setup route that trusts gh_init organizationId and userId values from the state parameter and calls createGithub, allowing an attacker to insert a GitHub App provider containing client_secret, webhook_secret, and PEM private key material into another organization.

Dokploy before version 0.29.13 contains a command injection vulnerability in the buildRemoteDocker() function, where the dockerImage value is directly interpolated into a docker pull shell command. An authenticated user with project access can execute arbitrary OS commands on the Dokploy server.

Dokploy before version 0.29.13 has a vulnerability in the WebSocket handler, where session validation does not authorize access to the requested server. An authenticated user can connect to a terminal on the Dokploy host without the required organization role or server-access check.

Flowise versions 2.2.4 through 3.1.4 have a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint, which is in the global authentication whitelist. An unauthenticated attacker can access private files from any chatflow, including those from other organizations.

GIMP's file format plugins, including those for PSD and PAA files, contain a vulnerability that a remote attacker can exploit by tricking a user into opening a specially crafted image file. This could lead to unexpected application behavior or other potential security impacts.

Dokploy from version 0.28.7 to 0.29.13 has a vulnerability in the server.remove tRPC mutation, which does not verify that the server's organization ID matches the session's active organization. An authenticated owner or administrator with server:delete in one organization can delete another organization's server and deployment records and receive the associated plaintext SSH private key.

Pega Platform versions 8.5.0 through 25.1.2 have an improper validation of cryptographic signatures issue, which may allow an attacker to bypass security controls.

Discourse has an SQL injection vulnerability in the Data Explorer plugin, allowing arbitrary SQL execution via query parameters, even by unprivileged users.

Discourse has a stored XSS vulnerability in the rich text editor, where a chat-transcript username is rendered as HTML.

In multicluster-global-hub, the manager improperly validates the source identity of incoming CloudEvents on Kafka status topics, allowing a remote attacker to falsify or delete data.

goose before version 1.44.0 has a vulnerability where the `goose review` command runs `git` without sanitizing configuration, allowing a malicious repository to execute arbitrary commands on the host.

SPIP before version 4.4.18 has a code injection vulnerability in SQLite-backed installations, allowing an authenticated attacker with editor privileges to execute arbitrary OS commands.