CVE Vulnerability Catalog

In vsDesk v14.0101, an authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to lack of server-side validation. This allows uploading arbitrary files, potentially leading to Remote Code Execution (RCE) within the web application context.

In Kata Containers, configurations using genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules, allowing mounting arbitrary container-rootfs paths over sensitive host locations or provisioning arbitrary content.

A weakness has been identified in itsourcecode Hospital Management System 1.0. It affects an unknown part of the file /viewappointmentpending.php. Manipulation of the argument delid causes SQL injection. The attack can be carried out remotely, and the exploit is publicly available.

In Comfast CF-N1-S version 2.6.0.1, the function sub_44B438 in /cgi-bin/mbox-config?method=SET&section=ptest_ssid (SSID Configuration component) has a stack-based buffer overflow via the ssid argument.

CodeAstro Apartment Visitor Management System 1.0 is vulnerable to SQL injection in password-recovery.php via the email argument. The attack can be performed remotely, and the exploit is publicly available.

CodeAstro Apartment Visitor Management System 1.0 is vulnerable to SQL injection in /apartment-visitor/forgotpw.php via the secode argument. The attack can be performed remotely, and the exploit has been publicly disclosed.

This CVE has been rejected or withdrawn by its CVE Numbering Authority.

In Banks before version 2.4.5, DirectoryPromptRegistry.set() in src/banks/registries/directory.py interpolates attacker-controlled Prompt.name and Prompt.version values into a Path without canonicalization or containment validation. Relative traversal such as ../victim/foo and an absolute Prompt.name can escape or discard the configured registry root, while overwrite=True permits replacement of existing target files. The poisoned name is persisted in index.json and reconstructed by _load(), allowing the out-of-root path to survive later registry loads. An application that forwards request data into these fields can therefore write Prompt.raw bytes to attacker-chosen paths writable by the application process. This issue is fixed in version 2.4.5.

In the unstructured library (from 0.4.7 to 0.24.0), the url argument in partition, partition_html, and partition_md is fetched without host validation, allowing an attacker to access loopback addresses, internal HTTP services, or cloud metadata endpoints.

Monkeytype 26.26.0 and earlier has a vulnerability in the rate-limit key generator that uses client-controlled cf-connecting-ip and x-forwarded-for headers before req.ip. An unauthenticated attacker can rotate these headers to bypass rate limits, allowing repeated requests to endpoints like forgotPasswordEmail and verificationEmail, causing mail bombing, exhausting Firebase/SMTP quotas, and evading brute-force protection.

Plate prior to 53.3.2 has a vulnerability in @platejs/docx-io that fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob in a server-side environment. The converter can make requests to internal network resources and include the fetched image bytes in the generated DOCX, allowing server-side request forgery with response disclosure.

Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to follow a substituted final symlink when opening a path with O_TRUNC instead of enforcing FinalSymlink::DontFollow, allowing the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions. The primitive does not provide arbitrary-content writes and requires winning the race. This issue is fixed in version 2.35.0.

Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries RequestSpec.cookies created from the dedicated [Cookies] section into the redirected request. An attacker-controlled redirect can therefore receive authentication or session cookies that should remain scoped to the original host. Cookies supplied through a raw Cookie header are stripped and are not affected by this specific path. This issue is reported as fixed in version 8.1.0.

Link Preview JS prior to 4.0.4 has a vulnerability in the resolveDNSHost mitigation that validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validation and a loopback or internal address during the final connection, bypassing SSRF protection.

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below storageDataPath. An attacker who can supply or modify an S3, GCS, Azure Blob Storage, or other backup source can place .. components in object names. When an operator restores that source, the crafted names can create or overwrite files outside the intended restore root within the filesystem permissions of the vmrestore process. This issue is fixed in versions 1.122.25, 1.136.12, and 1.146.0.

In dbx (prior to 0.5.51), auth_middleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when password_hash is None. A fresh deployment reaches that state when DBX_PASSWORD is unset, and the service binds to 0.0.0.0 on port 4224 by default.

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, a crafted CHM file can supply malformed LZX Huffman code lengths to make_decode_table in ext/CHMLib/lzx.c. In the long-code branch, the function writes new internal nodes through next_symbol before validating that the canonical Huffman table has overflowed. The PRETREE case can write beyond the 104-entry PRETREE_table into adjacent heap state in struct LZXstate when reached through chm_open, chm_retrieve_object, LZXdecompress, and BUILD_TABLE. This produces heap memory corruption in the parser process, while arbitrary code execution has not been demonstrated. No fixed version is available as of this review.

OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw custom_field_ project attribute. The dialog path resolves the project custom field by its raw identifier without enforcing the normal admin_only visibility scope and renders the stored custom-field comment in read-only mode. This discloses hidden comment text but does not disclose the custom-field value or permit writes or mutation. This issue is reported as fixed in version 17.6.0.

WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin() strips leading C0 control characters and spaces. An attacker-controlled value such as a space followed by a protocol-relative or absolute URL can therefore bypass SCHEME_RE and startswith("//") checks and be normalized to an off-host redirect. Request.relative_url() and webob.exc._HTTPMove subclasses, including HTTPFound, are also affected because they use the same unsafe URL joining behavior or bypass the earlier normalization path. An unauthenticated attacker who can influence an application's redirect target can send users to an attacker-controlled host for phishing or OAuth and SSO token theft, but exploitation requires the user to follow the redirect. This issue is fixed in version 1.8.11.

NanaZip from version 1.0.88.0 until stable 6.0.1698.0 and preview 6.5.1742.0 has a vulnerability in the Lz4Decode function that rejects only a zero return from LZ4_decompress_safe, while malformed input produces a negative error value. The negative int is converted to unsigned SizeT, leading to out-of-bounds read and potential data leak or crash.