CVE Vulnerability Catalog

The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.

Fortinet FortiAnalyzer 7.6.0 through 7.6.2, 7.4.1 through 7.4.6, FortiAnalyzer Cloud 7.6.2, 7.4.1 through 7.4.6, 7.2.1 through 7.2.9, and FortiManager 7.6.0 through 7.6.2, 7.4.0 through 7.4.6 contain an SQL Injection vulnerability (CWE-89). It may allow a low-privileged user to execute arbitrary commands via crafted requests.

A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.

A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox (including Cloud versions) may allow an attacker to escalate privileges via specially crafted HTTP requests.

An improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Fortinet FortiManager and FortiManager Cloud may allow an attacker to escalate privileges via specially crafted packets.

An Uncaught Exception vulnerability [CWE-248] in Fortinet FortiSandbox may allow a privileged attacker to persistently deny access to the GUI and CLI via crafted HTTP requests.

A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged with fstab options as strings; when the combined options are re-parsed, clearing options can override nosuid, nodev, and noexec protections the administrator intended to enforce.

A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity.

FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index.php that executes phpinfo(). A derived image that does not overwrite this placeholder serves the diagnostics page in production and can disclose environment variables used for secrets, PHP configuration directives, loaded extensions, software versions, and system paths. Images built using the documented pattern with their own /app/public/index.php are not affected, and already derived images must be rebuilt or supplied with an application index to remove the exposed placeholder. This issue is fixed in version 1.12.5.

A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true). An attacker can bypass the intended restriction by manipulating the signup workflow, resulting in unauthorized account creation.

Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to select post-authentication navigation, allowing a crafted state value to redirect a user to an attacker-chosen location. This issue is fixed in versions 15.116.0 and 16.29.0.

A vulnerability in the Bluetooth Classic Hands-Free Profile Audio Gateway (HFP AG) implementation in Zephyr RTOS causes corruption of the kernel timeout list. By sending AT+CIND? and quickly reconnecting, a remote attacker can trigger a system-wide fault or hang.

In the AVDTP signalling layer of the Zephyr RTOS Bluetooth stack, the L2CAP disconnect handler (bt_avdtp_l2cap_disconnected) failed to cancel the armed delayed timeout_work, leaving it linked in the kernel's global timeout list. When the bt_avdtp session struct is zeroed by memset() on reconnect, the kernel treats the still-linked timeout node as free, corrupting the global timeout list and causing a system-wide crash or hang. The vulnerability requires CONFIG_BT_A2DP (experimental) to be enabled and an encrypted BR/EDR link.

ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id} endpoints. Unauthenticated attackers can read unpublished draft and soft-deleted articles by requesting sequential article ids or supplying isDraft=true or isDel=true query parameters.

fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint. Authenticated members can read other members' refund records by registering freely and enumerating sequential refundId values, obtaining buyers' names, national ID numbers, addresses, WeChat openIds, and order details.

waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController. Authenticated members can modify or delete other members' cart items by enumerating sequential cart ids via PUT /cart, POST /cart/changeNum, and DELETE /cart/{cartId} to change quantities, selection state, or remove items.

waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController. Authenticated members can modify or delete other members' shipping addresses by enumerating auto-increment address ids and sending POST /address or DELETE /address/{addressId} requests.

Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by supplying their order identifiers. Attackers can enumerate sequential order ids or serial numbers via detail, cancel, confirm, delete and refund endpoints to read recipient addresses and phone numbers or disrupt orders.

PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight. GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight update goods and SKUs by id without store-scoped checks, letting sellers bind their own templates to competitors' products and alter shipping charges.

PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/{goodsId} to replace product details and SKUs and reassign products to their own store.