CVE Vulnerability Catalog

The StableLib library before version 2.0.4 contains a vulnerability in the CBOR decoder that allows an attacker to inject a '__proto__' key into a JavaScript object. This overwrites the object's prototype, potentially leading to security decisions based on attacker-controlled data.

The StableLib library before version 2.0.4 contains a vulnerability in the CBOR decoder that does not enforce a maximum nesting depth. A sufficiently deep structure can cause a JavaScript stack overflow, leading to a crash of the process or service.

Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git operations followed HTTP redirects without revalidating the destination. A repository administrator using a policy-allowed endpoint that redirects could make Gitea's Git client send requests to an address that the outbound host policy would otherwise block. The impact depends on the configured policy and the internal services reachable from the server.

Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access cancelled a run that was awaiting approval and then re-ran it, the new jobs were created as waiting rather than blocked while the run still recorded that approval was required. Cancelling and re-running stale fork checks is a routine action that does not involve the approval control, so where Actions is enabled and a matching runner is registered, workflow code taken from the fork pull request head could run on the repository's runners without an explicit approval.

A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer later approves the run, Gitea passed the already-cancelled job back through concurrency preparation, set it to waiting, and made it claimable by a matching runner, executing fork-controlled workflow code. Exploitation requires the maintainer's later approval action, Actions to be enabled, and a runner that accepts the repository's jobs.

When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without checking whether the new run still needed approval. Because fork pull request runs are inserted under the base repository, a user who can open a pull request from a fork could cancel trusted in-progress runs that share a concurrency group with `cancel-in-progress` enabled, without approval and without running any code. On self-hosted runners this can interrupt deployments and leave partial state behind.

Changing an organization team's permission through the API with only the `permission` field did not rebuild the team's per-unit access, and the requested level was not applied as a cap. After an organization owner demoted a team, for example from admin to read, the team's members kept their previous unit permissions, including write access to the team's repositories. The web form was not affected.

Elasticsearch contains an authorization bypass vulnerability in the Remote Cluster Security (RCS) 2.0 model. An attacker with a valid API key can send a specially crafted cross-cluster search request that is authorized for one index but actually operates on a different, unauthorized index, exposing its data.

Elasticsearch contains an incorrect authorization vulnerability in a configurable, non-default privilege that allows an administrator to delegate limited role-management capability. Due to incomplete enforcement of scope, a user with this privilege can expand their access to indices that should remain restricted, including internal security data.

Kibana contains an authorization bypass vulnerability in the Fleet package installation process. A user with delegated Fleet package-management privileges can claim a data stream identifier already in use by another tenant, redirecting the victim's data to infrastructure controlled by the attacker.

Arista Wi-Fi access points contain a memory corruption vulnerability in the wired uplink network endpoints. An unauthenticated attacker on the same network segment can crash the sensor service or potentially achieve remote code execution.

Arista Wi-Fi access points contain a vulnerability in the capture service. An unauthenticated attacker with network access can send a crafted packet to crash the service or potentially achieve remote code execution. This requires an uncommon non-default streaming mode.

Arista access points with WIPS active contain a vulnerability that allows an unauthenticated attacker within RF proximity to send a crafted frame to crash the sensor service, disabling WIPS monitoring, or potentially achieve remote code execution. No wireless association or authentication is required.

Arista Wi-Fi access points with captive portal or application firewall enabled on at least one SSID contain a vulnerability in the wireless gateway service. An unauthenticated network-adjacent attacker can send a crafted packet that triggers a stack overflow, resulting in a denial-of-service condition or potentially execute arbitrary code on the device.

An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge their source IP address and gain administrative session privileges on the CV-CUE backend.

An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute arbitrary commands with the privileges of the affected service.

An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious requests, leading to arbitrary local file disclosure and partial denial of service.

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS). Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting full access to their account and administrative permissions.

A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views affected content. Successful exploitation may allow the attacker to compromise the victim's authenticated browser session, access sensitive data, modify system state, or disrupt affected services.

A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affected configuration. Successful exploitation may allow the attacker to act through the victim's authenticated browser session to access sensitive data, modify configurations, or disrupt managed wireless services.