CVE Vulnerability Catalog

ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a malicious tst_sequence sequence attribute that is passed to unserialize(), abusing Guzzle or Monolog gadget chains to write PHP files and execute code.

A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an unknown functionality of the file sar2html.py. The manipulation of the argument SECRET_KEY results in hard-coded credentials. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset field. DatasetTableFieldDTO.dateFormat is inserted without validation into date conversion templates used by Dimension2SQLObj, CustomWhere2Str, Field2SQLObj, WhereTree2Str, and ExtWhere2Str. When a chart renders the field on a cross-datasource dataset, Calcite parsing is bypassed and the crafted format can directly alter the generated SQL.

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime values in dataset group-field binning definitions. Utils.transGroupFieldToSql inserts these free-form values into generated CASE expressions without validation, and the resulting SQL can reach unparameterized backend query execution when a chart uses the field.

DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names, connection usernames, table names, or database names to datasource metadata operations, including getSchema, validate, save, and update flows. CalciteProvider inserts these identifiers into metadata queries that are executed through a plain JDBC Statement, allowing the generated SQL to be altered and run against the configured backend with application-held datasource credentials.

cpp-httplib before version 0.51.0 fails to strip Cookie headers on cross-origin 301, 302, 307, and 308 redirects. The create_redirect_client() function removes Host, Proxy-Authorization, and Authorization headers but leaves Cookie headers attached, causing session cookies to be sent to the redirect target.

Sentry versions 26.5.0 through 26.7.2 contain a vulnerability in the SAML SSO identity-linking flow. An attacker controlling a SAML identity provider can socially engineer an authenticated user into opening a malicious URL, link the attacker's identity to the victim's Sentry account, and take control of that account.

The Vert.x HTTP/1.x decoder in versions [5.0.0,5.0.12], [5.1.0,5.1.9], and [5.2.0,5.2.0] uses canonicalization for well-known HTTP headers that misinterprets crafted headers as listed headers, e.g., Content-Xength as Content-Length. This enables request smuggling attacks.

Eclipse Vert.x Web versions [4.0.0,4.5.34], [5.0.0,5.0.12], [5.1.0,5.1.9], and [5.2.0,5.2.0] contain a scope bypass vulnerability in ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already authenticated by a preceding handler, ChainAuthHandler skips all scope validation configured via withScope() or withScopes().

dbt versions 2.0.0-alpha.0 through 2.0.0-alpha.5 expose an unauthenticated POST /api/v1/query endpoint in dbt docs serve, which passes caller-supplied SQL to DuckDbViewsBackend::query_arrow() without authorization or an allowlist. A client that can reach the server can invoke DuckDB filesystem-reading functions to read files available to the dbt process, including files outside the docs index directory.

F´ (F Prime) before version 4.2.0 has a vulnerability in the Svc::FpySequencer STORE directive stack write validation. The bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound to make an out-of-range destination appear valid.

F´ (F Prime) before version 4.2.0 has a vulnerability in Fw::FilePacket deserialization used by Svc::FileUplink. Header deserialization casts the byte to the Type enum without validating its range, and FilePacket::fromSerialBuffer reaches a default FW_ASSERT when a network file packet contains an unknown file-packet type byte.

F´ (F Prime) before version 4.2.0 has a vulnerability in Svc::FileUplink handleDataPacket offset and size validation. The component checks byteOffset plus dataSize with wrapping U32 arithmetic and then seeks to the large attacker-controlled offset before writing.

F´ (F Prime) before version 4.2.0 has a vulnerability in Svc::GenericHub fromBufferDriver_handler deserialization. The receive handler uses FW_ASSERT for externally influenced deserialization status and type validation and permits a command payload size subtraction to underflow.

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

A flaw in DPDK lib/vhost vhost-crypto causes the indirect-descriptor snapshot to double-fetch a guest descriptor next index. A malicious guest can exploit this to cause an out-of-bounds access in the host backend.

A flaw in DPDK lib/vhost: the VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to a use-after-unmap condition.

The FV Flowplayer Video Player plugin for WordPress, in all versions up to and including 7.5.54.7212, is vulnerable to limited arbitrary file upload via the check_mimetype function. Incomplete file type validation allows an authenticated attacker with subscriber-level access or above to upload potentially executable files, enabling remote code execution. Exploitation requires the plugin's 'profile videos on bio' option to be enabled.

ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (CWE-639). Any authenticated user can iterate the ID parameter to retrieve the full profile record of every other user, including passwords stored in cleartext (CWE-256), enabling account takeover and credential-stuffing attacks.

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php returned the FOG_AD_DEFAULT_PASSWORD value in its domainpass JSON field and could be dispatched through node=ipxe without an authenticated session. The response was also consumed by host and group Active Directory configuration interfaces. This could disclose the default domain-join credential to a remote unauthenticated requester. This vulnerability is fixed in 1.5.10.1870.