CVE Vulnerability Catalog

Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validating instead against a value the server itself generated for the request.

Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication does not enforce nonce uniqueness or timestamp freshness.

Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entry-editing rights on a weblog to cause the server to parse an attacker-influenced trackback response with an XML parser that does not disable external entity resolution, leading to disclosure of files readable by the Roller process.

Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP requests to attacker-chosen destinations through legacy outbound Trackback and entry enclosure handling. The Trackback control is hidden in the standard UI, but its action remains directly reachable, and the default empty Trackback allow-list permits all destinations. Requests can reach loopback and private-network addresses.

Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring rights on one weblog to read, modify, or delete resources belonging to another weblog through unscoped identifier-based lookups. This affects multi-user installations where users are intended to be isolated between weblogs. A user with administrator rights on their weblog can also overwrite another weblog's Velocity template, whose content is evaluated when the victim weblog renders.

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file updateresultdetails.php. Manipulation of the argument editid leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed publicly.

A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file makeresult.php. Manipulation of the argument makeid causes SQL injection. The attack can be initiated remotely, and the exploit has been made available to the public.

A vulnerability was determined in aaPanel BaoTa up to 11.8.0. The affected element is the function panelTask.bt_task._unzip of the file /www/server/panel/class/panelTask.py of the component Unzip Handler. Executing a manipulation of the argument Password can lead to OS command injection. The attack may be performed from remote, and the exploit has been publicly disclosed.

A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Manipulation of the argument Password leads to OS command injection. The attack can be executed remotely, and the exploit has been disclosed to the public.

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely, and the exploit is now public.

Joomla Extension regularlabs.com Tabs & Accordions (Pro) versions 2.3.0 - 3.1.0 is vulnerable to privileged stored XSS via data-rlta-url attributes. The plugin accepts a url option for an item and writes it to a generated data-rlta-url attribute, which the browser code passes to window.open() when the item is activated. Affected versions do not reject browser URL schemes that execute JavaScript.

Joomla Extension regularlabs.com Modules Anywhere versions 1.5.0 - 9.0.5 for Joomla is vulnerable to LFI / SSRF. Modules Anywhere Pro lets additional attributes on a module tag replace arbitrary parameters of the selected module. The overrides are applied without checking who authored the content containing the tag. The security effect depends on how the selected module consumes the replaced parameter; Joomla's core Feed module opens the rssurl parameter server-side and accepts local file: URLs as well as network URLs.

Vulnerability in OctoberCMS up to versions 4.1.19/4.2.25/4.3.4 in the getSourcePathForResize function of modules/system/classes/ResizeImages.php. Manipulation of the realSourcePath argument leads to server-side request forgery (SSRF). Remote attack possible, exploit public. Upgrading to 4.3.5 or 4.4.0 resolves the issue.

Vulnerability in Eyeplus 57.0.0.0308 in an unknown function of the p2pcam HTTP Parser component. Manipulation leads to stack-based buffer overflow. Remote attack possible, exploit publicly disclosed.

Vulnerability in athlon1600 youtube-downloader up to version 4.0.1 in the stream function of public/stream.php. Manipulation of the url argument leads to server-side request forgery (SSRF). Remote attack possible, exploit public. Commit 6ffe823 does not restrict destination host.

Vulnerability in Privoce VoceChat Server up to version 0.5.36 in the open_graph::fetch function of src/api/resource.rs in the open_graphic_parse Endpoint component. Manipulation of the url argument leads to server-side request forgery (SSRF). Remote attack possible, exploit publicly disclosed.

Vulnerability in Trusted Domain Project OpenDMARC up to version 1.4.2 in the opendmarc_policy_query_dmarc function in libopendmarc/opendmarc_policy.c of the Internationalized Domain Name Handler component. Manipulation leads to encoding error. Remote attack possible, exploit publicly disclosed.

Vulnerability in Trusted Domain Project OpenDKIM up to version 2.11.0 in the dkim_qp_decode function of util.c in the Decoder component. Manipulation leads to off-by-one error. Remote attack possible, exploit public.

Vulnerability in Trusted Domain Project OpenDKIM up to version 2.11.0 in the dkim_canon_selecthdrs function of libopendkim/dkim-canon.c in the DKIM Signature Header Selection component. Manipulation of the h argument leads to out-of-bounds write. Remote attack possible, exploit publicly available.

A vulnerability was found in Krayin laravel-crm up to 2.2.4. An unknown function in packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the admin-config-setup API Endpoint allows authorization bypass. The attack can be launched remotely and the exploit is public. Upgrading to version 2.2.5 mitigates the issue.