CVE Vulnerability Catalog

ServiceNow addressed a domain separation bypass security issue in the ServiceNow SR – CSM – Task Plan Templates Store application. The vulnerability could enable an authenticated user with a specific role to create records in domains they do not have access to, potentially leading to unauthorized data creation across domain boundaries. ServiceNow is not currently aware of malicious exploitation against ServiceNow instances.

WiFiman Desktop for macOS contains an Improper Access Control vulnerability. A malicious actor with local access and high privileges could exploit it to escalate privileges on the host device.

In node-forge before 1.4.1, the TLS client checked the wrong property when deciding whether a server certificate was missing. A malicious TLS server or on-path peer could omit the Certificate message and reach code that dereferenced the absent certificate, causing an uncaught exception and terminating the connection or process. This affects forge.tls.createConnection(), c.session.serverCertificate, and RSA key exchange.

In node-forge before 1.4.1, the forge.http client stored cookie names and paths from Set-Cookie response headers in ordinary JavaScript objects. A malicious server could use the cookie name __proto__ so that the attacker-controlled cookie path was written as a property on Object.prototype, or use inherited names such as constructor to modify Object. An empty cookie value could use the removal path to delete an inherited Object.prototype property. Applications using forge.http directly or through forge.xhr are affected.

In glob from 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke callbacks without returning. After AbortSignal or AbortSignal.timeout() rejects or emits an error, execution can continue into processor.processPatterns(), readdirCB(), and recursive traversal. The issue affects glob() and globStream() when applications expose attacker-influenced patterns or directory trees and rely on cancellation as a traversal budget.

SuperAGI up to v0.0.14 contains an improper access control vulnerability. The agent controller endpoint /api/agents/get/project/{project_id} allows authenticated users from one organization to retrieve the complete list of agents belonging to a different organization's project. The endpoint accepts a project_id parameter but does not verify that the project belongs to the authenticated user's organization.

In the Botan library, the botan ocsp_check command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the signer. A malicious responder or on-path attacker could return a matching and timely GOOD response with an empty, invalid, or unauthorized signature, causing a revoked certificate to produce exit status 0 and OCSP check OK output. Only the command-line interface is affected; the issue is fixed in version 3.13.0.

In the Botan library, the Python binding converted Python strings containing U+0000 to const char* values without consistently rejecting the embedded NUL, causing bcrypt and check_bcrypt to process only the prefix before the NUL. Applications could validate a longer password but hash a shorter effective value, allowing application password-policy bypass; scrypt and argon2 are unaffected. The issue is fixed in version 3.13.0.

In the Botan library, the online OCSP client prior to 3.13.0 allowed a single HTTP redirect while posting an OCSP request to the URI in a certificate's Authority Information Access extension. A malicious OCSP responder or on-path attacker could redirect the client to make one blind request to an otherwise unreachable internal HTTP service, resulting in blind SSRF; response timing can provide a coarse internal-service oracle. The issue is fixed in version 3.13.0.

The socket.getaddrinfo() function accepted null bytes within the *host* and *port* parameters, which could cause the values to be silently truncated. This may lead to unintended name resolution or connections to a different address than intended.

HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints. An authenticated user with read permissions in one namespace may view information about objects in other namespaces. This is fixed in Nomad Community Edition 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

In minimatch before 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This is fixed in version 11.0.1.

In Kubeflow Pipelines from 0.5.1 until 2.17.0, frontend artifact routes did not check whether an authenticated user was authorized to access the requested namespace. A user knowing an artifact location could select another tenant's namespace or omit the namespace to read artifact contents such as datasets, models, or pipeline outputs.

A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70 allows attackers to scan internal resources via supplying a crafted URL.

Broken Object Level Authorization in the Users Configuration Endpoint allows Information Disclosure to an authenticated user.

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability due to allocation of resources without limits or throttling. A remote authenticated attacker could exploit this to cause a denial of service.

Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a vulnerability due to improper neutralization of directives in dynamically evaluated code in the Manager web console. An authenticated Manager administrator could exploit this to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process.

Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a vulnerability due to improper limitation of a pathname to a restricted directory. An unauthenticated attacker could exploit this to affect files outside the intended directory.

Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a vulnerability due to a missing release of backend receiver sessions in the Ad Hoc Transfer component. This could lead to server resource exhaustion and service degradation.

Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user's password to access certain files associated with that account without satisfying multi-factor authentication requirements.