CVE Vulnerability Catalog

Frappe version 16.31.0 and earlier has a vulnerability where the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An attacker can induce an authenticated victim browser to submit an approval action with the victim privileges. No released fixed version is available as of this review.

django CMS prior to 5.0.9 has a vulnerability in page duplication that lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidden source field, AddPageForm.clean does not validate the source against the user, and AddPageForm.save calls from_source. In cms/admin/pageadmin.py, duplicate and PageAdmin.has_add_permission check only whether a staff user may add a page. A crafted source value can therefore copy every placeholder and plugin from an unauthorized page with permissions=False, stripping source view restrictions and exposing content across sites or restricted subtrees when CMS_PERMISSION is enabled.

Frappe version 16.31.0 and earlier has a type confusion vulnerability in frappe.client.set_value, which checks a dictionary supplied via the fieldname parameter against forbidden fields before parsing it into individual field names. An authenticated caller can exploit this to mass-assign protected fields through the client endpoint. No released fixed version is available as of this review.

django CMS prior to 5.0.9 has a vulnerability in render_object_structure that fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.use_structure or model-level view or change permission can request the //admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/ endpoint with guessed content_type_id and object_id values. The response discloses placeholder slot names, plugin trees, plugin identifiers, labels, and object existence for frontend-editable objects. The fix applies user_can_view_placeholder_source to the non-PageContent branch while keeping the structure board read-only for view-only users.

django CMS prior to 5.0.8 has a vulnerability in render_object_structure in cms/views.py that renders cms/toolbar/structure.html for a PageContent object without calling user_can_view_page(). Any staff account can request a restricted page’s structure when CMS_PERMISSION is enabled and the page has view restrictions or CMS_PUBLIC_FOR is set to staff. The response exposes plugin get_short_description() values, including link names, URLs, and text snippets, rather than only the page shape.

django CMS before version 5.0.8 has a vulnerability in the copy_plugins endpoint that authorizes only the destination clipboard but does not validate the source placeholder. A staff user with global add permission for a plugin type can copy plugins from unauthorized pages and read secret text, link names, and URLs.

This CVE has been rejected or withdrawn by its CVE Numbering Authority.

libgit2 before versions 1.8.6 and 1.9.5 performs a fixed-size strncmp in set_data without verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can cause format_str to advance beyond the pkt-line and the following memchr length calculation to underflow, leading to a heap out-of-bounds read that can crash a client during the first refs-advertisement packet.

libgit2 before versions 1.8.6 and 1.9.5 has a vulnerability in the built-in HTTP transport that allows following an offsite redirect and sending credentials to an untrusted host. An attacker controlling a trusted Git host or an open redirect can disclose HTTP Basic credentials, personal access tokens, or equivalent credentials.

libgit2 before versions 1.8.6 and 1.9.5 has a vulnerability in git_delta_apply that trusts the attacker-controlled res_sz value, potentially leading to excessive memory allocations and memory exhaustion. Malicious pack data can be supplied via git_clone, git_fetch, git_remote_fetch, git_indexer_append, or a local repository.

libgit2 before versions 1.8.6 and 1.9.5 does not reject traversal components in a submodule path loaded from .gitmodules. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree.

libgit2 before versions 1.8.6 and 1.9.5 has a vulnerability in verify_server_cert that uses an inverted !!memcmp result in the GEN_IPADD branch when comparing an IP-literal host with a certificate IP SubjectAltName. This causes rejection of matching IP addresses and acceptance of mismatched ones, allowing an attacker with a CA-trusted certificate to intercept connections to IP-literal HTTPS URLs.

Frappe version 16.31.0 and earlier has a vulnerability in the whitelisted toggle_like and mark_as_seen endpoints that do not enforce read permission before modifying _liked_by metadata or a Note seen state. An authenticated user can interact with documents or notes that the user cannot read, disclosing resource existence and modifying resource-associated metadata.

Shaarli before version 0.16.3 is vulnerable to stored XSS in BookmarkListController.php. The permalink handler concatenates the raw bookmark title into the page title and emits it into the <title> element without HTML escaping. A bookmark title containing </title><script>...</script> can execute a script in the Shaarli origin for any visitor. An attacker can convince an administrator to bookmark a malicious URL, leading to administrator account takeover.

SecureDrop Client before 1.3.1 can be tricked by a malicious SecureDrop Server responding with cross-origin redirects, bypassing securedrop-proxy's origin limitation.

This CVE has been rejected or withdrawn by its CVE Numbering Authority.

This CVE has been rejected or withdrawn by its CVE Numbering Authority.

This CVE has been rejected or withdrawn by its CVE Numbering Authority.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.