CVE Vulnerability Catalog

A vulnerability in Seahub before version 13.0.23 allows unauthenticated users to bypass the SHARE_LINK_LOGIN_REQUIRED enforcement on the GET /api/v2.1/share-link-zip-task/ endpoint. Attackers with a folder share-link token can obtain a fileserver zip token and download entire shared directory trees.

A vulnerability in Maxun before version 0.0.42 allows authenticated users to access other users' robots and OAuth tokens by bypassing ownership checks in storage and webhook API handlers. Attackers can read plaintext Google and Airtable access tokens, modify, delete, or execute other users' robots.

A stack buffer overflow vulnerability in Hydra through version 9.7 (fixed in commit 9cc84c2) affects NTLM authentication in SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules when processing malicious NTLM Type-2 challenges. A remote server can send a crafted challenge with an excessively long domain string, causing base64-encoded response data to overflow a 500-byte stack buffer by 18 to 330 bytes, enabling remote code execution on systems without stack protection.

In File Browser before version 2.63.16, an authenticated user with only Create permission can delete files outside their scope (including other tenants' data and the application's database) by exploiting the cleanup path after a failed upload. The ScopedFs.RemoveAll method bypasses symlink protections, and the direct upload handler calls it on a user-controlled path.

SeaweedFS before version 4.30 has a vulnerability due to improper path cleaning in S3 and Iceberg REST catalog routers. An attacker can use '..' sequences in a request to bypass access controls and read or write data in any bucket.

In K3s before versions 1.35.3+k3s1, 1.34.6+k3s1, and v1.33.10+k3s1, a path traversal vulnerability exists in the etcd snapshot decompression functionality. ZIP archives containing maliciously named members can be written to arbitrary filesystem locations when an administrator restores the archive as a compressed etcd snapshot.

File Browser before version 2.63.6 contains a vulnerability where a low-privileged authenticated user with create and delete permissions in their own isolated scope can permanently destroy share-link records belonging to other users, including the administrator. This is done by performing a legitimate DELETE operation on a file whose logical path is a byte-prefix of another user's stored share.Link.Path.

File Browser prior to version 2.63.7 allowed creating public shares for any path without verifying the existence of the file. When a file was created at that same location, the share became immediately active, leading to unauthorized access to files.

File Browser prior to version 2.63.14 does not prevent HTTP file handlers from following symbolic links, allowing users to cross their intended scope boundaries.

A vulnerability in File Browser prior to version 2.63.6 allows files with backslash characters in their names to be saved, potentially leading to unauthorized file writes outside the target directory when extracting the archive on Windows systems.

In File Browser before version 2.63.6, the maximum password length is not checked, allowing an arbitrarily long password to be sent to the login API. This causes a spike in CPU and memory usage, leading to container crashes and potentially disrupting the Docker daemon.

File Browser before version 2.63.6 contains a vulnerability due to incorrect path handling in public shares. An attacker who knows the URL of a public directory share can bypass rules blocking access to files and subdirectories located under the shared directory. The issue arises because the system rebases the filesystem root to the shared directory and then evaluates paths relative to it, instead of relative to the owner's original scope.

File Browser before version 2.33.8 allows bypassing the command allowlist using shell metacharacters. The allowlist only validates the first token of user input, but the entire raw string is passed to the shell, allowing arbitrary commands to be executed after a permitted one.

File Browser is a file management interface that, starting from version 2.0.0-rc.1, allows unauthenticated attackers to impersonate users, including admins, by sending a forged HTTP header. No credentials are required to gain access.

File Browser prior to version 2.63.6 had a vulnerability in the Hook Authentication feature that allowed delegating login verification to an external shell command. User-supplied credentials were interpolated into this command string without sanitization, enabling remote attackers to execute arbitrary OS commands before any authentication.

Glances is a system monitoring tool that, from versions 4.0.8 to 4.5.5, has a vulnerability in the secure_popen() function. This function interprets redirection, pipe, and command chaining operators without validation, allowing unauthorized actions on the system.

Vulnerability in Cursor before version 3.0 allows a malicious agent to write files outside the workspace without user approval. The agent uses an in-workspace symlink pointing outside and forces path canonicalization to fail, resulting in writing to an arbitrary location. This enables non-sandboxed remote code execution, e.g., by overwriting the sandbox helper.

A vulnerability in Cursor before version 3.0 allows a malicious agent to modify the working_directory parameter, enabling file writes outside the intended workspace. This can lead to remote code execution without user interaction, e.g., by overwriting the cursorsandbox helper.

A vulnerability in the SYMCRYPTO hardware module (SiXG301) allows weakening of DPA (Differential Power Analysis) countermeasures by forcing specific seed values. An attacker with code execution capability on the device can reduce the entropy of protection mechanisms, increasing the risk of cryptographic key extraction.

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server does not validate the HTTP Host header, leaving it vulnerable to DNS rebinding attacks. An attacker can exploit DNS rebinding to exfiltrate the full system monitoring dataset from a victim's browser.