CVE Vulnerability Catalog

An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components.

Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the backed-up content from another Text section.

Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated.

A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute arbitrary code via a crafted expression.

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary channel via a crafted PATCH request.

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, and 11.8.x <= 11.8.3 fail to validate BoardMember.Scheme* fields server-side on insert and archive-import paths, allowing a board editor or non-guest team member to grant board admin to arbitrary users.

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. It affects some unknown functionality of the file /BSCE2.php. Manipulation of the argument course leads to cross site scripting. The attack may be launched remotely, and the exploit is publicly available.

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.set_tokens and OnyxTokenStorage.set_client_info in backend/onyx/server/features/mcp/api.py copy per-user tokens into a shared admin MCPConnectionConfig row and _db_mcp_server_to_api_mcp_server returns that row through auth_template.headers to any BASIC_ACCESS user. This issue is fixed in versions 3.1.10, 3.2.14, and 4.0.0.

MLflow prior to 3.15.0 allows authenticated users to create a model version referencing another user's artifact directory and read files without the required READ permission.

MLflow is an open source AI engineering platform. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE_REQUEST_HANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs for another user's run_id and inject attacker-controlled DatasetInput records into the dataset_inputs lineage metadata without UPDATE permission. This issue is fixed in version 3.15.0.

An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components.

Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensitive information via the validatePath function in api/hermes/download endpoint.

A heap-based out-of-bounds write vulnerability exists in S2OPC 1.7.3 in server-side EventFilter handling during CreateMonitoredItems processing. This allows a remote attacker to execute arbitrary code.

SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code.

A vulnerability in the WebKit component of Safari was addressed through improved state management. Processing maliciously crafted web content may lead to an unexpected Safari crash.

An out-of-bounds read was addressed with improved input validation. This vulnerability affects Apple systems and may allow an app to cause unexpected system termination or read kernel memory.

An issue addressed with improved checks affects iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS. Processing an image may lead to a denial-of-service.

An integer overflow was fixed with improved input validation. The vulnerability affects Apple systems and was resolved in multiple versions. Processing an image may lead to arbitrary code execution.

A use-after-free vulnerability was fixed with improved memory management. The issue affects Apple systems and was resolved in iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. A remote attacker may cause unexpected system termination.

A memory handling issue in the web content processing component was addressed with improved memory handling. The flaw affects Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS. Processing maliciously crafted web content may lead to memory corruption.