CVE Vulnerability Catalog

An authentication bypass vulnerability in the default SFTP server used across Ciena products allows a remote, unauthenticated attacker to bypass security controls and gain unauthorized access to the underlying filesystem. Successful exploitation could allow reading or modifying system files.

An SSRF vulnerability in Anti-Virus for ownCloud before version 1.2.3 (and ownCloud 10 before 10.15.3) allows an attacker to send requests from the server to internal network resources. The flaw is due to insufficient URL validation in the antivirus component.

In ownCloud Core prior to version 10.15.3, the Updater exposes a dangerous method or function. This allows attackers with administrative privileges to execute arbitrary code on the server.

An authenticated user can manipulate a company ID parameter in a POST request to the backend to gain unauthorized access to other companies hosted within the same subdomain environment. The application does not adequately verify whether the requested company ID belongs to the authenticated user's session, resulting in a cross-tenant authorization bypass.

The Apache Camel AWS SNS component lacks an inbound filter rule in the Sns2HeaderFilterStrategy. However, the vulnerability is not exploitable because the component is producer-only (does not support consumers), so an attacker cannot supply external message attributes to the Camel Exchange. A defense-in-depth filter was added for consistency with other strategies.

A vulnerability in the camel-keycloak component of Apache Camel allows bypassing access token verification in the default configuration. When required roles or permissions are empty, the token is not cryptographically verified, allowing access to protected routes with any Authorization header.

A vulnerability in the Apache Camel DNS component allows SSRF attacks via improper input validation of message headers. An attacker can set dns.server, dns.name, and dns.domain headers in an HTTP request, redirecting DNS queries to a controlled server and disclosing internal hostnames.

Vulnerability in Apache Camel's mongodb-gridfs component allows an attacker to manipulate GridFS operations via HTTP headers. Improper input validation and access control enable unauthorized file deletion, reading, enumeration, and NoSQL operator injection.

Vulnerability in Apache Camel Solr component allows SSRF and injection of Solr parameters and fields. Exchange headers with SolrParam. and SolrField. prefixes are passed unfiltered from HTTP requests to the Solr producer, enabling attackers to manipulate queries and indexed documents.

Vulnerability in Apache Camel AWS2-SQS component allows attackers to inject Camel control headers (e.g., CamelHttpUri, CamelFileName) via SQS messages. Missing inbound filtering in Sqs2HeaderFilterStrategy enables modification of downstream producer behavior in the route.

The camel-keycloak component in Apache Camel lacks validation of the access token's validity window. The helper function does not check whether the token is expired or not yet valid, accepting tokens outside their intended lifetime.

Vulnerability in Apache Camel Cometd component allows an attacker to inject arbitrary Camel control headers into the message exchange. Missing HeaderFilterStrategy causes client-supplied headers, including internal Camel headers (e.g., CamelHttpUri, CamelFileName), to be copied unmodified. Default lack of authentication (Bayeux SecurityPolicy) lets any client publish such messages.

A deserialization vulnerability in the Apache Camel PQC component allows untrusted data deserialization from AWS Secrets Manager. The flaw stems from missing input filtering during Java object deserialization, potentially leading to remote code execution.

A vulnerability in the camel-docling component of Apache Camel allows CLI argument injection and directory traversal due to insufficient validation of exchange headers. Attackers can supply unauthorized flags or paths that escape the intended directory, leading to unexpected operations by the external docling tool.

The internal RPC interface of Apache IoTDB DataNode for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use path traversal sequences in the JAR name to write files outside the intended Trigger installation directory. This could allow arbitrary file write with the permissions of the IoTDB process.

An authentication bypass vulnerability via spoofing has been found in Apache IoTDB. Thrift RPC query handlers do not properly validate the sessionId parameter, allowing an attacker to forge requests and receive query results without authentication. Affected versions are from 1.3.3 before 2.0.8.

The WordPress plugins FileOrganizer (before 1.1.9), Advanced File Manager (before 5.4.12), File Manager Pro (before 2.1.1), and File Manager (before 8.0.4) fail to properly escape a parameter before passing it to a shell command during image processing. This allows authenticated users to perform OS Command Injection, provided the server has the ImageMagick convert CLI available and the PHP imagick and GD extensions are absent.

The Prog Management System by PROG MIS has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to view a specific page and obtain the database account and password.

The ERP application developed by PROG MIS has a Use of Hard-coded Credentials vulnerability, allowing unauthenticated remote attackers to log in to view application code and obtain the database account and password.

An unauthenticated improper input validation vulnerability in the POST /fetch_cve_data endpoint in cve-search allows a remote attacker to manipulate request parameters to read arbitrary application MongoDB collections. This can expose administrative usernames and password hashes from the mgmt_users collection.