CVE Vulnerability Catalog

A vulnerability was found in DTStack Taier 1.4.0 in the function Paths.ge of the file FileChunkController.java in the Chunk-Check Endpoint component. Manipulation of the argument Name results in path traversal. The attack may be launched remotely, and the exploit has been made public.

A vulnerability was found in DTStack Taier version 1.4.0, affecting the MultipartFile.getOriginalFilename function in UploadController.java. Manipulation of the File argument leads to path traversal. The attack can be initiated remotely.

A vulnerability was determined in dromara lamp-cloud up to version 5.10.0 in the file FileChunkController.java of the chunk-check endpoint component. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely, and the exploit has been publicly disclosed.

A vulnerability was found in Dromara lamp-cloud up to version 5.10.0 in the file FileAnyoneController.java of the File-Upload Controller component. Performing a manipulation of the argument bucket/bizType results in path traversal. The attack can be initiated remotely, and the exploit has been made public.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

A vulnerability in lamp-cloud up to version 5.10.0 affects an unknown part of DefGenProjectController.java in the Code Generator component. Manipulation of outputDir/parent/projectPrefix arguments leads to path traversal. The attack can be launched remotely, and the exploit has been publicly disclosed.

A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the function explore_url of the file src/mcp-rdf-explorer/server.py of the component MCP Server. Performing a manipulation of the argument url results in server-side request forgery. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

OpenChoreo prior to 1.0.2 and 1.1.2 served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/ and /api/exec/ operations, proxy the data-plane Kubernetes API, and execute commands in workload pods in multi-cluster deployments.

OpenChoreo prior to 1.0.3, 1.1.3, and 1.2.0-rc.2 exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected data planes.

OpenChoreo before versions 1.1.6 and 1.2.3 authorizes component:exec and wirelogs:view using the caller-supplied project query parameter instead of the component's owner project name. This allows a user with project-scoped grants to execute commands and read wirelogs from components owned by other projects in the same namespace.

OpenChoreo prior to versions 1.0.3, 1.1.3, and 1.2.0-rc.2 has a vulnerability in the POST /api/v1alpha1/autobuild endpoint. Webhook provider selection relies on attacker-controlled X-Event-Key, and Bitbucket requests are accepted without HMAC-SHA256 verification. This allows unauthenticated build triggers for components matched by repository URL and branch, including cross-provider attacks using attacker-supplied commit SHAs.

OpenChoreo before versions 1.0.4, 1.1.4, and 1.2.0-rc.2 has a vulnerability in Workflow Plane templates where developer-controlled parameters are interpolated into shell code executed via sh -c instead of being passed through container.env. This allows arbitrary commands to run in workflow pods, and affected privileged Podman templates lacked hostUsers: false.

OpenChoreo before versions 1.0.4, 1.1.4, and 1.2.1 has a vulnerability in the Backstage backend where default authentication policy is hardcoded to be disabled and guest access is allowed outside development. This results in unauthenticated access to /api/*, allowing unauthenticated catalog reads, scaffolder log reads, and catalog location creation or deletion.

FreePBX prior to 17.0.9 has a vulnerability in the UCP Node server on ports 8001 and 8003, where the checkAuth middleware is applied only to the default Socket.IO namespace. An unauthenticated client can connect to custom namespaces and send crafted event values with CR/LF, allowing arbitrary commands to execute as the asterisk service user.

FreePBX from version 17.0.5.34 to 17.0.11 has a vulnerability in the publicKeySave AJAX endpoint in Backup.class.php, which accepts an administrator's SSH key and appends it to authorized_keys without reliably enforcing restrictions. The key grants persistent shell access with the ability to execute arbitrary commands, access FreePBX and call data, modify system files, and disrupt services.

FreePBX from 16.0.0 until 16.0.11 and 17.0.4 has a vulnerability in the missedcall module, where the Caller ID name from crafted SIP From headers is inserted into an SQL query without escaping. An unauthenticated caller can inject SQL when a monitored extension goes unanswered, allowing modification of administrator accounts and unauthorized remote access.

FreePBX from version 17.0.1 to 17.0.7 has a vulnerability in the Music on Hold module that permits dangerous command-line options for /usr/bin/mpg123 and other allowed players. An administrator can use options that write files, open control channels, or create Asterisk call files, resulting in arbitrary command execution as the asterisk user.

FreePBX before versions 16.0.47 and 17.0.30 has a vulnerability in the Framework module that allows a crafted backup to restore the hidden AUTHTYPE setting with the value none. An authenticated user with backup-restore access can disable FreePBX authentication during restoration, bypassing the UI removal of AUTHTYPE=none.

FreePBX before versions 16.0.6 and 17.0.5.4 has a vulnerability in the Text-To-Speech module that allows an administrator to save a TTS destination name that is HTML-encoded, decoded during dialplan generation, passed as an AGI argument, and used to build filenames in agi-bin/propolys-tts.agi. The destination name reaches a raw shell-command execution path, allowing arbitrary OS command execution as the asterisk user.