CVE Vulnerability Catalog

MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatial_shape() in monai/bundle/scripts.py. The function validates shape expressions with a helper that walks the AST and only collects ast.Name nodes, rejecting any name other than 'p' or 'n', before passing the string to eval(). Expressions built solely from constants and attribute, subscript, or call nodes contain no ast.Name nodes and bypass the allowlist. An attacker who can influence a bundle's metadata can escape the eval sandbox and achieve code execution.

In MONAI 1.6.0, PersistentDataset explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors to run torch.load(hashfile, weights_only=False). Related cache helpers also call pickle.loads on cached content and use hashlib.md5 for cache keys. A local user with write access to a shared cache directory can place a malicious pickle file that is deserialized the next time another user's MONAI pipeline reads the cache, resulting in arbitrary code execution in that user's context.

MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves _target_ values to arbitrary importable callables without an allow list and passes $ expressions to Python eval(). Attackers can publish a malicious bundle with crafted configuration containing arbitrary code that executes when a victim loads the bundle using monai.bundle.load() or monai.bundle.run().

In Contrast versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable to an AML injection attack ("BadAML"). A malicious host can supply an ACPI table with arbitrary AML bytecode that the guest kernel interpreter executes with access to all guest memory, including private pages. This affects AMD SEV-SNP platforms (Metal-QEMU-SNP and Metal-QEMU-SNP-GPU); Metal-QEMU-TDX is not affected.

In Contrast versions before 1.19.1, Kata agent policies generated by the Contrast CLI contained a flaw in CopyFile verification that allowed arbitrary writes to the guest root filesystem. A malicious process on the untrusted host able to connect to the Kata agent VSOCK could overwrite security-critical files or trick the workload into disclosing sensitive data, effectively amounting to a full guest takeover.

Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any correctly verified TEE attestation report with the expected firmware patch levels and software measurements, regardless of which machine produced it, so attestation was not bound to specific, physically trusted hardware. An attacker able to intercept network traffic and forge reports can impersonate a Contrast Coordinator or workload, defeating identity verification in aTLS.

A flaw has been found in coollabsio Coolify up to 4.1.2 in an unknown function of app/Http/Middleware/CanUpdateResource.php in the Route-Level Middleware component. Manipulation can lead to missing authorization, and the attack can be launched remotely. The exploit has been published and may be used.

vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application exposes Node's zlib module through NodeVM's builtin allowlist, zlib.deflateSync can return a Buffer backed by Node's shared small-buffer pool whose .buffer is the entire pool. Untrusted guest code can construct a full-width view of that ArrayBuffer to read and modify bytes belonging to unrelated host buffers.

Contrast versions before 1.4.1 — a recovering Coordinator does not verify the seed supplied by the recovering party. An attacker can stand up a rogue Coordinator whose manifest passes validation but whose secret seed is attacker-controlled. If network traffic is redirected from the legitimate Coordinator to the attacker's Coordinator, a workload owner can be impersonated when they set a new manifest without comparing the returned root CA certificate against the existing one or verify the Coordinator without comparing the root CA certificate against a trusted reference.

Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRAST_LOG_LEVEL set to info or debug. Because info is the default, all installations that do not customize the initializer log level are affected. This exposes workload secrets to Kubernetes users with get or list permission on pods/logs and to anyone with read access to the Kubernetes log storage, such as the cloud provider.

Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. In versions 1.9.0 before 1.12.2, the initializer logs the full NewMeshCert response — which contains the workload secret — to standard output at INFO level. As a result, workload secrets are exposed to any Kubernetes user with get or list permission on pods/logs. Because workload secrets are used for encrypted storage and Vault integration, those must also be considered compromised.

A SQL injection vulnerability was detected in CloudClassroom-PHP-Project in the viewresult.php file, triggered by manipulating the seno argument. The flaw can be exploited remotely and a public exploit is already available. The product follows a rolling release model, so no specific version details are provided, and the vendor did not respond to the disclosure.

Kibana Agent Builder is affected by a Confused Deputy vulnerability (CWE-441) that can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be performed under the identity of a higher-privileged user. If the same user can also author workflows, this can extend to full administrative control of Kibana and the Elasticsearch cluster.

The Groups – Memberships and Access Control plugin for WordPress in versions up to and including 4.6.0 is vulnerable to privilege escalation. The groups_join() function derives group-join eligibility from the ambient post's author capabilities via the global $post->post_author rather than the authenticated user's own capabilities, while also minting a valid groups-join-data hash and nonce. An authenticated attacker with Subscriber-level access can enroll into any group, including privileged ones, and ultimately escalate to Administrator.

The Joomla UP plugin extension (lomart.fr) in versions 5.0.0-5.2.0 and 6.0.0-6.0.29 contains various path traversal and file access vectors. An attacker can access files outside the intended directory.

The Joomla UP plugin extension (lomart.fr) in versions 5.0.0-5.2.0 and 6.0.0-6.0.29 contains an authenticated, privileged PHP command injection vulnerability. An attacker with appropriate privileges can execute arbitrary PHP commands.

The Joomla AcyMailing Enterprise extension in versions below 11.1.0 contains a remote code execution vulnerability in the mailbox action feature. MIME parts of incoming emails were saved to media/com_acym/upload/ with no extension check, so anyone who could email the monitored mailbox could write a PHP file into the web root.

Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as configuration.php.

Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authenticated role) uploads an SSL certificate for one of their own domains, the Certificates API add()/update() methods parse it with openssl_x509_parse() and store the issuer organization (issuer['O']) value verbatim without sanitization. Froxlor's table-listing renderer then emits scalar cells through Twig's `raw` filter, disabling HTML auto-escaping, so when an administrator or reseller opens Domains > SSL certificates the attacker-supplied issuer value executes as script in the privileged user's session. This crosses a privilege boundary from customer to admin and can result in full administrator account takeover; because a Froxlor admin controls webserver, DNS, and PHP configuration applied by a cron job running as root, the issue can be further escalated to command execution as root on the managed server. The issue is fixed in Froxlor 2.3.12.

Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command. When an administrator has enabled the allowed-sender feature but disabled external allowed-sender domains (mail.enable_allow_sender = 1, mail.allow_external_domains = 0), an authenticated customer with API access can still use EmailSender.add to register an arbitrary external sender address for their mailbox, which is stored despite the policy. This creates a bypass between the UI/administrator configuration and the API, and — where the generated mail configuration consumes the allowed-sender table — allows a customer to authorize sender identities outside their hosted domains, facilitating sender spoofing. Fixed in 2.3.12.