CVE Vulnerability Catalog

Coturn version 4.15.0 has a vulnerability that allows an authenticated TURN user to repeatedly resume allocations from fresh UDP 5-tuples without completing a handoff when --mobility is enabled. This leads to unbounded server-side sessions and process memory exhaustion even with --user-quota=1 configured.

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMAC remains valid because it covers only the message prefix. Server-side parsing in src/server/ns_turn_server.c continues past MESSAGE-INTEGRITY through handle_turn_allocate(), handle_turn_create_permission(), handle_turn_refresh(), and handle_turn_command(), allowing trailing LIFETIME, XOR-PEER-ADDRESS, or ORIGIN attributes to override allocation lifetime, inject a permission, or bypass the origin check. TLS and DTLS deployments prevent this in-transit modification. This issue is fixed in version 4.15.0.

In Coturn before 4.13.0, an authenticated TURN user can place printf-style format specifiers in STUN USERNAME or REALM attributes, which pass is_secure_string() validation and are embedded into Redis keys. send_message_to_redis() passes the attacker-controlled key as the format argument to redisAsyncCommand(), causing reads past the va_list. Exploitation can crash the coturn process or disclose stack memory into Redis.

Coturn before version 4.15.0 has a vulnerability where an unauthenticated client can send a STUN message over TCP/TLS with a body-length field from 65520 through 65532, causing the len variable in stun_get_message_len_str() to wrap. This leads to desynchronization of the stream parser and drops the attacking client's connection, but does not affect other clients or the server process.

A race condition in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

In LiquidJS from 10.26.0 to 10.27.1, the strip_html filter can enter an infinite loop when the input contains '<', has at least one preceding character, and no later '>'. This blocks template rendering and can cause denial of service with input as short as 'a<'.

Lemmy-ui before version 0.19.19-beta.1 renders Markdown without sanitization, allowing HTML injection and JavaScript execution in the lemmy-ui origin. An approved member or a remote federated instance can store malicious content, and a viewer who renders it may execute script, potentially exposing the viewer's session and authenticated actions.

Lemmy before versions 0.19.19 and 1.0.0-alpha.18 does not check the block list when editing private messages. A blocked sender can still edit old messages that the recipient can see, enabling post-block harassment.

Lemmy before versions 0.19.19 and 1.0.0-alpha.18 allows a lower-ranked moderator to remove a higher-ranked moderator by sending a signed ActivityPub Remove activity. The verification does not check moderator rank, enabling a junior moderator to strip senior moderators from the community moderator list.

Lemmy before versions 0.19.19 and 1.0.0-beta.1 returns different errors during login depending on whether the username or email exists. A nonexistent account returns 404, while an existing account with a wrong password returns 400. This discrepancy allows an unauthenticated attacker to confirm registered usernames or email addresses.

Lemmy before versions 0.19.19 and 1.0.0-beta.1 uses the first X-Forwarded-For value as the client address for rate limiting. The bundled nginx config appends the real client address to a client-supplied value, allowing an attacker to spoof the address and bypass limits on multiple API endpoints.

Koel before version 9.7.1 incorrectly treats NAT64 and 6to4 addresses as public, allowing an authenticated user to place such an address in a podcast RSS and trigger requests to internal services or cloud metadata. The response body is returned to the user.

In Koel before 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without SafeUrl and HasAudioContentType checks. The stored URL is passed to RadioStreamProxy::openStream(), which calls fopen($url, 'r', false, $context). This allows access to internal HTTP services such as loopback, RFC1918, Docker bridge, or metadata.

Koel before version 9.7.0 in the Subsonic createPodcastChannel.view route does not apply SafeUrl validation, allowing an authenticated user to provide a private URL. This causes immediate server-side requests to loopback, Docker bridge, or RFC1918 destinations.

In Koel before 9.7.1, outbound podcast and radio fetch paths perform a point-in-time isPublicHost() or isSafeUrl() check without pinning the validated address, and most paths lack redirect-hop validation. This allows following an attacker-controlled redirect to an internal address or connecting after DNS rebinding. These paths are reachable through podcast and radio APIs, allowing an authenticated user to access internal services or cloud metadata.

In Termix before 2.3.2, the POST /host/db/proxy/test endpoint accepts singleProxy, proxyChain, and testTarget fields without validating destination addresses. The testProxyConnectivity path uses raw TCP and SOCKS connections to attacker-selected hosts and ports, allowing an authenticated user to probe localhost, private networks, link-local metadata services, and other infrastructure. Connection errors disclose host reachability, and metadata access can expose cloud credentials.

Termix before version 2.6.1 contains a vulnerability in the GET /host/db/host/:id/password endpoint that does not enforce host ownership during credential resolution. An authenticated user can enumerate host IDs and retrieve SSH or sudo passwords belonging to other users.

In Termix before 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table contains password-reset artifacts, allowing a low-privileged authenticated user to recover another account's reset code and complete the password-reset flow. Successful exploitation results in local-user account takeover and administrative compromise when the victim is an administrator.

Termix before version 2.3.2 contains a vulnerability in the terminal WebSocket that allows an authenticated low-privileged user to use another user's credentials to connect to an attacker-controlled SSH server. This can lead to disclosure of SSH passwords or private keys.

Termix before version 2.3.2 contains a vulnerability in the SSH tunnel teardown path that interpolates user-controlled data into a pkill command pattern. An authenticated user can inject a shell command that executes when the tunnel is disconnected.