CVE Vulnerability Catalog

A memory-corruption vulnerability exists in a kernel-mode component of BeyondTrust Endpoint Privilege Management (Windows deployments) prior to version 26.1.2, due to insufficient validation of input, potentially leading to out-of-bounds memory access.

In UpTrain version 0.7.1 and prior, the /new_run endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user with access to UpTrain and a valid authentication method may be able to execute arbitrary code in the context of the host running UpTrain, which in most cases will be the docker container.

In UpTrain version 0.7.1 and prior, the /add_prompts endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user with access to UpTrain and a valid authentication method may be able to execute arbitrary code in the context of the host running UpTrain, which in most cases will be the docker container.

UpTrain version 0.7.1 and earlier contains a remote code execution vulnerability in the `/create_project` endpoint via the `checks` and `metadata` parameters. Any user with access to UpTrain and valid authentication can execute arbitrary code in the context of the host running UpTrain, usually a Docker container. No patch is available as of publication.

UpTrain version 0.7.1 and earlier creates a default user with a static username, which is also used as the default API key. The backend has an open CORS policy, allowing any website to make authenticated cross-origin requests using the default API key in the `uptrain-access-token` header. This may allow arbitrary websites to perform privileged operations on the UpTrain instance.

Kiota before versions 1.29.1 and 1.34.0 allows an attacker who controls or tampers with the OpenAPI description to supply a file reference that resolves outside the manifest package (e.g., ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary.

In openshift-metal3/fakefish, some shell scripts inject variables without quoting them into command lines or manifests. This mostly applies to the Image URL and BMC credentials, which are not verified by FakeFish.

FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the cluster to control VMs of the user that created fakefish, power them on and off, and mount arbitrary CD images to them.

The Mattermost GitLab plugin (versions <=11.8, 10.20.11, 11.5.7.0) fails to verify channel permissions when processing API requests with a caller-supplied post_id, and fails to validate the web_url parameter against the configured GitLab instance. This allows an authenticated attacker to inject bot-authored messages containing arbitrary URLs into channels they do not have access to via the createIssue and attachCommentToIssue API endpoints.

Mattermost versions 11.8.x <= 11.8.2, 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to restrict channel member role assignment to channel-scoped roles, which allows a channel administrator to gain additional channel permissions via the channel member roles API.

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate that users have read access to a channel before linking a board to it, which allows an authenticated attacker to discover the membership of private channels on the same team via creating, patching, importing, or bulk-creating boards with an arbitrary channelId.

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs, which allows a run participant to modify status, checklists, retrospective content, ownership, and participants on completed runs via REST and GraphQL API requests.

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions, which allowed an OAuth app with a delegated user token to revoke the user's authorizations or tokens for other integrations via account-management endpoints.

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import, which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file.

Mattermost versions 11.7.x <= 11.7.6, 11.8.x <= 11.8.3 fail to re-validate that each target channel still belongs to the requesting admin's team when calling the policy unassign endpoint. This allows an authenticated team administrator to remove ABAC policy assignments from channels outside their team after a channel has been moved to another team.

OpenText Directory Services through version 22.2 contains an input data manipulation vulnerability.

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to reconcile SchemeAdmin flags with a user's current role, which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.

Dell ObjectScale versions prior to 4.3.0.1 contain an insertion of sensitive information into log file vulnerability in svc_tools. A low privileged attacker with local access could exploit this to disclose information.

Dell ObjectScale versions prior to 4.3.0.1 contain an OS Command Injection vulnerability. A low privileged attacker with local access could exploit this to elevate privileges.

Dell ObjectScale versions prior to 4.3.0.1 contain a Path Traversal vulnerability. A low privileged attacker with local access could exploit this to tamper with information.