CVE Vulnerability Catalog

XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS) in the GLUE code editor. JobCodeController.save() stores the user-supplied glueSource parameter without output encoding, and the FreeMarker template job.code.ftl renders the stored value unescaped.

tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed location, causing an infinite loop and denying service to a program that reads the crafted file. This issue is fixed in version 2.3.0.

In @libp2p/webrtc prior to 6.0.28, the webRTCDirect() Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, and protocol negotiation. The packet-controlled request.ufrag is forwarded to DirectRTCPeerConnection.setLocalDescription and reused as an ICE password without validating its required length and character set, causing an uncaught native invalid_argument and process abort with SIGABRT.

Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Removing Important Client Functionality. This issue affects Booking and Rental Manager: from n/a through 2.8.0.

The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, PropertiesBasedResumableProcessor stores resumable download state at the predictable shared path $java.io.tmpdir/ahc/ResumableAsyncHandler.properties with default permissions and link-following file operations. A local user who can read the shared store can see download URLs, including embedded user information or query tokens. A local user who can write within or pre-create the affected shared store directory can plant a symbolic link that the client follows when saving state, truncating and overwriting a target file writable by the client process. The filesystem path is used when ResumableAsyncHandler decorates another AsyncHandler, while the no-argument constructors use a no-op processor and are unaffected. This issue is fixed in versions 2.16.1 and 3.0.12.

A flaw in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, used by WildFly and JBoss EAP for deployment management, allows an attacker with the Deployer RBAC role to use path traversal sequences to access files outside the deployment directory. This can lead to deletion of arbitrary directories or creation of files with arbitrary content, resulting in full privilege escalation to the SuperUser role.

A Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExtension.php and the mediaDirFunc method.

An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component.

In Lychee before 7.7.1, the POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array that is merged after server-computed purchase parameters. An unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before passing to an Omnipay gateway, allowing underpayment and acquisition of goods.

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAPI documentation configured by config/scramble.php to unauthenticated callers after installation, with observed response size and latency suggesting that the schema is regenerated without an application-level cache. A remote attacker can repeatedly request the unthrottled route to consume server CPU and obtain a detailed map of the API surface and parameter schema.

In Lychee before 7.7.0, ImageMagick PDF support with Ghostscript does not apply an effective pre-render limit to PDF page dimensions in ImagickHandler::loadPdf(). An authenticated user can upload a small PDF with an oversized /MediaBox, causing significant CPU consumption and clogging the image-processing queue.

In Lychee before 7.7.0, the hidden Omnipay Dummy test provider can be used by a buyer (including a guest) by submitting it directly, as CreateSessionRequest does not enforce OmnipayProviderType::isAllowed(). This allows completing the test gateway flow without a real payment and releasing the purchasable item if auto-fulfillment is enabled.

In Lychee before 7.6.4, SecurePathController serving GET /image/{path} concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under a specific non-default configuration, any authenticated user can read files outside the intended directory, including application configuration and other users' private images.

In Lychee before 7.6.3, the GET /api/v2/Zip endpoint authorizes album and photo archives through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first enforcing AlbumPolicy::canAccess(). For a public, password-protected album with grants_download enabled, an unauthenticated attacker who knows the album identifier can download a ZIP archive without supplying the password.

In Lychee before 7.6.1, the POST /api/v2/Album::unlock endpoint has no throttle, attempt counter, backoff, CAPTCHA, or lockout. A remote unauthenticated attacker who knows the album identifier can automate password guesses against a password-protected album and gain access to its private photo collection.

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photos_star_visibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved() invokes SetPhotosHighlightedRequest::processValidatedValues() before authorization, and PhotoPolicy::canHighlight() returns true for anonymous callers without a canSee check. An unauthenticated attacker who can guess photo identifiers can distinguish existing private photos through differing success and not-found responses and can change their is_highlighted state, including for photos in private or password-protected albums. The issue is limited to installations using the non-default anonymous star-visibility setting. This issue is fixed in version 7.6.1.

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.php for a separate fopen connection. An authenticated attacker who controls DNS responses can cause validation to observe a public address and the subsequent fetch to resolve the same hostname to a private or otherwise forbidden address. This DNS rebinding time-of-check to time-of-use mismatch bypasses the intended server-side request forgery protections and can reach services available from the Lychee server, subject to deployment and TLS behavior. This issue is fixed in version 7.6.0.

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a javascript URI in an album or photo Markdown description because config/markdown.php enables allow_unsafe_links. PreformattedPhotoData.php and PreFormattedAlbumData.php convert the description to HTML, and gallery components render that HTML with v-html, so a visitor clicking the rendered link executes attacker-controlled JavaScript in the Lychee origin.

Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)

The XStore plugin for WordPress contains a Reflected XSS vulnerability caused by improper neutralization of input during web page generation. The issue affects versions prior to 9.7.9.