CVE Vulnerability Catalog

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via IMAP command injection.

Roundcube Webmail before 1.6.18 and 1.7.3 has improper HTML/CSS sanitization of the SVG animate "by" attribute that may lead to remote image blocking bypass, potentially resulting in information disclosure or privilege escalation.

Roundcube Webmail before 1.6.18 and 1.7.3 is vulnerable to stored XSS in the "Add to address book" action.

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS proxy were not validated, which may result in information disclosure or XSS via MIME sniffing.

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmd_learn driver.

Dell iDRAC9 versions prior to 7.20.30.50 and Dell iDRAC10 versions prior to 1.20.60.50 contain a Remanent Data Readable after Memory Erase vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information disclosure.

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store and re-distribute those resources as belonging to another zone. The result is a cross-zone isolation bypass: the holder of a single enrolled zone's credential can inject, attribute, and overwrite resources in another zone's namespace mesh-wide. The root cause lives in Kuma's open-source KDS sync code, which Kong Mesh's control plane is built on.

Missing Authorization vulnerability in Dolusoft Software Technologies Fortilogger allows accessing functionality not properly constrained by ACLs. This issue affects Fortilogger before 6.1.5.9.

In Logsign SIEM, there is an insufficiently protected credentials vulnerability that allows retrieving embedded sensitive data. Affects versions from 6.4.97 before 6.4.114.

In Wavlink WN531P3 and WN535M1 V250922, the strcpy function in the file /etc/lighttpd/www/cgi-bin/export_pingortrace.cgi (Export Pingortrace CGI component) is vulnerable to stack-based buffer overflow via manipulation of the HTTP_COOKIE argument. The attack can be launched remotely, and the exploit has been publicly disclosed.

OutSystems Service Center is vulnerable to DOM-based Cross-Site Scripting (XSS) that can be exploited by a low-privileged attacker via uploading a file with a malicious filename containing JavaScript code. The vulnerability exists in all locations where files can be attached and prepared for upload. Fixed in version 11.41.2.

openssl_encrypt before version 1.4.0 contains an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify ciphertext in transit to bypass integrity verification and perform bit-flipping attacks without detection.

openssl_encrypt before version 1.4.0 contains a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and publicly available encapsulated key data. Attackers who obtain 16 bytes of the private key can compute the shared secret and decrypt all ciphertext, as the fallback triggers on any KEM failure without raising an error.

openssl_encrypt before version 1.4.0 contains a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() builtins. Attackers can traverse the Python class hierarchy via __class__.__mro__.__subclasses__() to access system functions and execute arbitrary OS commands.

openssl_encrypt before version 1.4.0 contains a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute traversal techniques. Attackers can use __class__, __bases__, __subclasses__(), and __globals__ chains to access restricted functions and execute arbitrary system commands from plugin code.

openssl_encrypt before version 1.4.0 fails to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules.

openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bearer token in the Authorization header.

openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any client_id to gain authenticated access to keyserver and telemetry APIs.

openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication.

openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data.