CVE Vulnerability Catalog

Routers TR1200 and TR3000 with firmware versions v2.4.15 and v2.4.21 contain a command injection vulnerability in the system.setclock interface. Attackers can execute arbitrary commands as root via crafted input.

Copier versions 9.5.0 through 9.16.0 contain a vulnerability that allows bypassing the trusted repository prefix. Percent-encoded path segments or separators in a template URL can match a configured trusted prefix before decoding by the HTTP server or Git transport, enabling unsafe template features from a repository outside the trusted prefix after user interaction.

Coturn from 4.5.2 through 4.14.0, when started with --acme-redirect and a plaintext-TCP listener, allows an unauthenticated client to send an HTTP GET request and receive a 301 response leaking up to ~870 bytes of adjacent process heap memory. The leaked region may contain other clients' TURN credentials, OAuth tokens, or relayed payloads.

REDAXO from 5.18.2 through 5.21.1 allows an authenticated backend user with media[upload] permission to upload a JPEG/PHP polyglot file named shell.php.any.jpg, which web servers with multi-extension PHP handlers can execute as the web-server user.

Savon from 0.9.8 through 2.17.2 in Savon::Model.all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing arbitrary Ruby code execution in the application process.

In Strands Agents Tools before 0.8.2, incorrect authorization in the http_request tool may allow remote attackers to obtain credentials configured via HTTP_REQUEST_TOKEN_CONFIG by influencing the LLM to route requests through attacker-controlled proxy infrastructure.

Thumbor before 7.8.0 in the filters:proportion(<value>) filter does not enforce an upper bound on <value> and runs in the post-transform phase. An attacker can trigger extremely large resizes (CPU/memory exhaustion) and cause denial of service.

Thumbor before 7.8.0 in the convolution filter uses a regular expression that performs exponential backtracking on crafted repeated numeric input, allowing a URL request to exhaust processing time.

Thumbor before 7.8.0 in the filters:convolution(<matrix>, <columns>, <should_normalize>) filter passes the user-controlled <columns> value to a C extension where it is used as a divisor without validating columns > 0. When columns=0, the C code triggers undefined behavior; on x86_64 this reliably results in a fatal divide-by-zero trap (SIGFPE) and crashes the Thumbor process, causing a remote denial of service.

Thumbor before 7.8.0 in file_loader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILE_LOADER_ROOT_PATH through watermark or frame filter input.

Thumbor before 7.8.0 in HMAC validation uses Python's .replace() to remove the signature from the URL before validation. Since .replace() removes all occurrences of the substring, an attacker can insert the same signature multiple times in the URL and manipulate the final URL used for validation, enabling loading images from unintended domains or paths.

Thumbor before 7.8.0 in the ALLOWED_SOURCES configuration passes plain strings to re.match() without escaping dots, so a hostname differing at dot positions can match the allowlist.

Stored XSS in participant URL handling in AWS Ops Wheel before PR #168. Allows an authenticated remote user to steal session tokens and escalate to full administrative control via a crafted participant_url with a dangerous URI scheme.

In hashi-vault-js before 0.5.2, src/Vault.js concatenates unencoded identifiers into Vault request paths and query strings without encodeURIComponent() and URLSearchParams, allowing path traversal and query parameter injection.

In @phun-ky/defaults-deep before 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype (prototype pollution).

In DSSRF before 1.0.5, is_url_safe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing SSRF.

Wings, the server control plane for Pterodactyl, prior to version 1.13.0 contains a vulnerability causing a Go panic due to a malformed packet received during the SFTP connection handshake. This issue is fixed in version 1.13.0.

In the aap-gateway component of Ansible Automation Platform's Event-Driven Ansible (EDA), a vulnerability allows an unauthenticated remote attacker to bypass mTLS authentication for event streams. The attacker can manipulate the event stream URL and forge the HTTP Subject header, while the system inadvertently discloses the expected certificate subject in error messages.

In pgAdmin 4 from version 7.2 before 9.17, the MASTER_PASSWORD_HOOK setting allowed shell command injection via a username containing shell metacharacters (e.g., ';', '$()', backticks). The username from external auth sources (OAuth, Kerberos) could be used to execute arbitrary commands as the pgAdmin service account.

A vulnerability in pgAdmin 4 allows SQL injection via improper escaping of object names in query templates. A low-privileged user can create an object with an apostrophe in its name, which when another user opens the Statistics or Dependencies tab leads to arbitrary SQL execution in the database session.