CVE Vulnerability Catalog

Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before evaluating the "Add Message Attachments" permission, which was only checked after the file had been stored. A user denied that permission, or an unauthenticated visitor on a guest-posting configuration, could import approved files of allowed types into the file manager.

Concrete CMS 9.0.0 to 9.5.2 dashboard group type controller did not validate a CSRF token on its delete action, resulting in cross-site request forgery. A remote unauthenticated attacker could cause an authenticated user with group type management permission to delete a custom group type.

Concrete CMS 9 before 9.5.3 did not escape SQL LIKE wildcard characters in the keyword search filters used by the file manager, file folders, and page list. An authenticated user with editor-level or higher privileges could submit a crafted search containing many single-character wildcards, forcing the database to perform a full-table scan and degrading responsiveness.

Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details controller resolved a board instance directly from an attacker-supplied instance ID and then viewed, refreshed, regenerated, or deleted it without verifying edit_board_settings on the parent board. A user with board-edit rights on one board could reach instances of any other board.

Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advanced_search() method resolved an Express entity directly from a user-supplied entity ID and rendered that entity's entries without invoking canViewExpressEntries(), allowing an authenticated dashboard user with view_express_entries on one entity to read entries of any other entity, including secret attribute values.

Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller (update, update_data_source, and delete_data_source), which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming edit permission on the owning board. A user with edit_board_settings on one board could modify or permanently delete data sources of any other board.

Inspektor Gadget from 0.28.0 until 0.53.1 has a flaw in the USDT note parser (pkg/uprobetracer/usdt.go). When a custom gadget with a SEC("usdt/...") eBPF section attaches to a crafted ELF binary, an unprivileged container can trigger an out-of-bounds panic or consume gigabytes of memory, crashing or exhausting the privileged Inspektor Gadget process.

FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when worker thread creation fails after device registration. An attacker can trigger thread creation failure during channel setup, causing device pointer deallocation while devman retains a reference, leading to crash or code execution.

OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. An authenticated administrator can submit a non-HTML upload filename matching an existing file in the application's working directory. The application passes the user-controlled filename to unlink() when rejecting the upload, potentially causing file deletion and denial of service.

OpenBao prior to 2.5.5 allows users granted capabilities on /sys/namespaces/root within a non-root namespace to exploit special handling of the literal root path in namespace canonicalization. ACL checks occur before root canonicalizes to an empty path, so /sys/namespaces/root resolves to the system backend's containing namespace, allowing permitted lookups, deletion, locking, or custom metadata changes against that namespace.

OpenBao prior to 2.5.5 allows a user with access to sys/leases/revoke/:lease_id in one namespace to revoke a lease in another namespace when the foreign lease_id is known. The lease lookup routing in vault/expiration.go lets FetchLeaseInfo and loadEntry resolve lease data outside the request namespace, enabling one tenant to revoke another tenant's lease and underlying credential.

ToolHive prior to 0.29.1 has a flaw in networking.IsPrivateIP (pkg/networking/utilities.go) that omits the IPv6 NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48. NAT64 addresses embedding private, loopback, or link-local IPv4 targets are classified as public and allowed, enabling blind probing of internal TCP/TLS reachability on a host behind a NAT64/DNS64 gateway.

A flaw has been found in OpenClaw ClawScan up to 0.1.6 in an unknown function of internal/runner/static_scanner.go in the Static Scanner component. The manipulation causes incomplete comparison with missing factors, and the attack can be launched locally. The exploit has been published and may be used.

A vulnerability was detected in OpenClaw ClawScan up to 0.1.6 in the IsBinaryFile function of internal/runner/static_scanner.go in the File Classifier component. The manipulation results in interpretation conflict, and local access is required. The exploit is now public and may be used.

Dragonfly prior to 2.4.4 registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc() or RBAC(), while the handler returns models.Oauth records with client_secret exposed in JSON. When an administrator has configured a GitHub or Google OAuth provider, an unauthenticated network client can retrieve the provider's client secret, client identifier, and redirect URL.

In Keyfactor SignServer before 7.6.0, several properties were identified to have no restrictions on what path they can be set to by an admin user. Setting these properties to specific file paths can reveal information to the client side. This includes ATTRIBUTESFILE in PKCS11CryptoToken, KEYSTOREPATH in KeyStoreCryptoToken, and TRUSTSTOREPATH in RenewalWorker.

In Keyfactor SignServer before 7.6.0, the output file for SignerStatusReportWorker can be set to any path, even one pointing to an existing file. This allows a user with admin access to write files in arbitrary directories and potentially overwrite files accessible by the local JBoss user.

gss-ntlmssp contains a memory leak in the NTLM target-info parser when a crafted NTLM CHALLENGE message contains duplicated string-valued AV_PAIR entries. The parser allocates memory for each string value but does not free the previous allocation when the same AV_PAIR type appears more than once, leading to gradual memory exhaustion on the client during NTLM authentication.

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process.

A vulnerability was detected in GNU Binutils 2.47 in the function elf_x86_allocate_dynrelocs in bfd/elfxx-x86.c, leading to a null pointer dereference. The attack requires local access, and the exploit is public.