CVE Vulnerability Catalog

In Apache HTTP Server's mod_charset_lite from 2.4.0 through 2.4.68, an out-of-bounds write vulnerability exists.

In mod_auth_digest of Apache HTTP Server before 2.4.69, missing authentication checks allow an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck.

In the revoked-key error path, a human-readable failure reason is built using sprintf() into a heap buffer, but the allocated buffer is too small for the final formatted message, which can lead to a write past the end of the heap allocation.

The Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products does not properly enforce authentication. A local, authenticated attacker can bypass the driver's access-control handshake and issue arbitrary privileged commands to the driver, resulting in disclosure of kernel and process memory.

A flaw was found in Foreman's foreman-rake initialization logic in /usr/share/foreman/config/settings.rb, where configuration data is processed through two distinct executable layers. This enables Server-Side Template Injection (SSTI) and insecure deserialization, potentially leading to remote code execution.

OS command injection vulnerabilities exist in Foreman's foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call.

A command injection vulnerability exists in Foreman's foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization.

The Red Hat Satellite /unattended/provision API endpoint in Foreman is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request.

A command injection vulnerability exists in rubygem-foreman_remote_execution's Red Hat Satellite API (/api/v2/job_invocations). When a job template has the effective_user property marked as overridable: true, the application fails to properly sanitize the effective_user input provided during the API request.

Prior to version 1.1.35, GraphQL Tools' executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loader with SubscriptionProtocol.LEGACY_WS, can accept an attacker-controlled certificate.

The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences processed by computeExtractionParameters() and resumableZipExtractor().

Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portmux. A remote unauthenticated attacker can submit a malformed ClientHello and terminate boks_portmux.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server.

NULL Pointer Dereference vulnerability in Apache HTTP Server's mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server from 2.4.0 through 2.4.68.

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a user to open a crafted Web UI link whose aas or path query parameter points to an attacker-controlled endpoint. The user's browser would then send the configured Basic Authentication credentials, Bearer token, or an available OAuth2 access token to that endpoint. The attacker could reuse the disclosed credential to access protected AAS services with the victim's privileges. The issue is fixed in v2-260924.

Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions.

Contributor PHP Object Injection in Icegram <= 3.1.31 versions.

Subscriber Broken Access Control in Social Boost <= 3.6.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.

Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.