CVE Vulnerability Catalog

A vulnerability in girishsaraf Online-Appointment-Booking-System up to version f427b4757128ca253d33d0cc4e87bbb9c999a4d5 involves missing authorization in the file changebookingstatus.php, in the submit2 Handler component. Manipulation of the username[]/timestamp[]/status[] arguments leads to missing authorization. The attack can be performed remotely, and the exploit is publicly available. The vendor has not responded.

A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5, specifically in Admin/showdoctor.php, due to missing authorization. The attack can be carried out remotely, and the exploit has been publicly disclosed. The project has not responded, and due to its rolling release strategy, specific version details cannot be provided.

An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool (part of BlueZ) when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys exceeding actual packet data, causing btmon to read beyond the allocated buffer and crash.

In MongoDB mongos, an authenticated user with readWrite privileges can crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage lacking proper authorization checks, allowing a subsequent stage to execute on the router under unintended conditions, resulting in an unhandled fatal error that immediately aborts mongos. This causes denial of service for all clients routed through the affected instance.

MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access.

An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.

Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or actions can invoke FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, or LINK_SCHEMA to read or write arbitrary files on the Metabase server or link other databases. The default sample database uses H2, so the vulnerable surface is exposed by default.

In Plane prior to 1.4.0, multiple issue-listing endpoints, including unauthenticated public deploy boards, pass the user-controlled order_by parameter to Django's order_by without allowlist validation. An attacker can use double-underscore relationship traversal to reference arbitrary related model fields, revealing database schema details through errors and potentially disclosing field values through differential ordering. Fixed in version 1.4.0.

A vulnerability in Plane before version 1.4.0 involves failure to sanitize unsafe URL schemes in comments (comment_html). A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser of another user who clicks the link. The issue is fixed in version 1.4.0.

In self-hosted Plane deployments prior to 1.4.0, unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/ through WorkspaceJoinEndpoint expose the secret invitation token directly and through get_invite_link. An external attacker can retrieve a token intended for another user and submit it to the invitation acceptance flow, joining the workspace without receiving the invitation and gaining the role assigned to the invite. Fixed in version 1.4.0.

In JupyterLab from 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to resolve the current document rather than retaining the document whose command button was clicked. If another document becomes current while the prompt is open and the user chooses Trust, JupyterLab marks the second document trusted while leaving the clicked document untrusted. Later command buttons in the incorrectly trusted document run without a prompt, and trusting a notebook marks all cells trusted, saves unsaved edits, and persists the server signature to disk. Fixed in versions 4.5.11 and 4.6.4.

asteval, a Python expression evaluator for restricted execution, prior to 1.0.9 allows sandbox escape. With numpy enabled, the default Interpreter exposes a ctypes type and permits from_address memory access, while attribute assignments use unfiltered setattr. An attacker-controlled expression can read or corrupt process memory, execute code, or disclose secrets.

The vulnerability in Xen concerns the GNTTABOP_cache_flush operation, which may be issued on memory mapped from another domain using the grant table interface. There was no restriction to disallow the use of invalidate-without-clean against read-only grant mappings, which may corrupt the granted memory.

The vulnerability in Xen concerns the GNTTAB_cache_flush operation, where the error path after adding a NULL check fails to drop a page reference if the page is owned by a special system domain (DOM_IO or DOM_COW).

The vulnerability in Xen concerns the GNTTABOP_cache_flush operation, where the fix for XSA-437 introduced a calculation that may underflow, resulting in a loop that would take excessively long, potentially crashing the hypervisor, especially on 64-bit Arm.

Electron applications on macOS using Squirrel.Mac-based automatic updates are vulnerable to a local race in the privileged ShipIt helper prior to 39.8.10, 41.10.5, and 42.0.0-beta.2. The helper did not bind the validated update target to one canonical application-bundle path, allowing a local attacker to redirect the root-level write and overwrite another application's files.

Axios versions 1.15.0 through 1.20.0 incorrectly treat NO_PROXY CIDR entries as textual hostname suffixes instead of network ranges. A request to an address covered by a CIDR entry in NO_PROXY is not matched and is sent through the configured proxy. For plaintext HTTP the proxy can observe and modify URLs, headers, and bodies; for HTTPS it can observe connection metadata and CONNECT requests.

The vulnerability in ProPhoenix Law RMS version v2022.2403.3.101 is a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Alert/MsgType parameter in the errorHandler.aspx endpoint.

An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId cookie.