CVE Vulnerability Catalog

The Rattadan Cosmowarp smart contract before version 56c6147 can have a comparison to an unintended value of current_admin. This may lead to incorrect contract logic behavior.

InvoicePlane before version 1.7.2: Invoices::generate_xml() appends a database-derived xml_id to the XMLconfigs helper directory and includes the resulting PHP path without validating the identifier. A low-privileged attacker who can influence the e-invoice configuration can use traversal sequences to include an existing PHP file. Code execution requires a separate file-upload or file-write primitive.

InvoicePlane before version 1.7.2 exposes Invoices::delete() and Invoices::delete_invoice_tax() as state-changing routes without requiring POST and validating a CSRF token. When an authenticated administrator loads attacker-controlled content that requests an affected route, the application can delete an invoice or invoice tax record. The cross-origin action can remove financial data without the administrator's intent.

Piwigo before version 16.4.0: check_upgrade_access_rights() in admin/include/functions_upgrade.php conditionally escapes the submitted username only when the removed get_magic_quotes_gpc function exists, so PHP 8 and later concatenate an unauthenticated username directly into the upgrade authentication SQL query. When database upgrades are pending, a crafted query result can satisfy the status and password checks, set PHPWG_IN_UPGRADE, and authorize upgrade execution without valid administrator credentials.

Piwigo before version 16.4.0: admin/element_set_ranks.php stores administrator-controlled image_order[] values without enforcing the existing sort-field whitelist. The stored album image_order expression is later concatenated into ORDER BY clauses by admin/batch_manager_global.php, admin/batch_manager_unit.php, include/section_init.inc.php, and include/ws_functions/pwg.categories.php. When at least one album contains at least one photo, an authenticated administrator can store a crafted expression and trigger it in a later album or Batch Manager query to disclose, modify, or disrupt database data.

In Piwigo prior to 16.4.0, admin/batch_manager.php accepts administrator-controlled dimension width, height, ratio, and filesize values from the Batch Manager filter URL without numeric validation. These values are stored in the bulk_manager_filter session state and concatenated into SQL predicates, allowing an authenticated administrator to inject SQL expressions. The issue is fixed in version 16.4.0.

In InvoicePlane prior to 1.7.2, the administrator-controlled tax_rate_decimal_places setting is interpolated into an ALTER TABLE statement for ip_tax_rates in Settings::index() without strict integer validation. A crafted setting value can add clauses to the schema-changing statement and remove or alter required database columns. The vulnerability is fixed in 1.7.2.

In Google gVisor prior to commit 573a9e73cf844f, on Linux platforms with CUSE enabled, improper exposure of a resource in the host file helper (gofer) allows a local attacker with container image deployment privileges to achieve root code execution on the host. By including a /dev/cuse character device node in a container image, the attacker can register a host device and exploit CUSE unrestricted ioctl handling to overwrite root udev helper memory.

IBM Server Firmware versions FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker on the management network can send a malformed HTTPS request to ASMI, causing the web server to crash with possible memory corruption and generate an error log. The ASMI web interface restarts automatically, but repeated exploitation could result in a sustained loss of access to the ASMI management interface.

IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the Universal Connector Oracle Wallet upload component. An authenticated remote attacker could exploit this vulnerability to write arbitrary files to the system.

IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit this vulnerability to execute arbitrary code on the affected system.

A security flaw has been discovered in Open-Web-Analytics up to 1.8.1 in the Event::loadFromArray function of the queue.php file in the Remote Event Queue Endpoint component. Data manipulation results in deserialization, and the attack can be initiated remotely. Upgrading to version 1.8.2 addresses this issue.

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user.

Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion (e.g., disguising SVG content as PNG), an attacker can trigger unintended interpretation of embedded SVG elements that reference local files. In more advanced scenarios, Imagick's support for Magick Scripting Language (MSL) may be abused to process attacker-controlled instructions, potentially leading to unauthorized server-side file writes and remote code execution. This has been patched in 16.4.0.

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality. An authenticated attacker can provide a crafted GIM bundle that causes attacker-controlled arguments to be passed to the tar command, resulting in arbitrary command execution with elevated privileges on the Central Manager.

IBM Guardium Data Protection 12.2 improperly limits a pathname to a restricted directory, allowing a remote attacker to obtain sensitive information, delete arbitrary files, or execute arbitrary code.

IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sensitive information in the internal database.

IBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible plaintext-equivalent format. An authenticated attacker who gains access to the stored credential could recover the password and obtain an administrative REST access token.

The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting (XSS). Usernames imported from chats and crawled forums are stored without character restrictions and rendered into the DOM using D3's html() method in the tooltip, allowing arbitrary JavaScript execution in the analyst's browser when hovering over a timeline entry.

The AIL Framework contains a stored cross-site scripting (XSS) vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content. Dynamic values are interpolated directly into the data-content attribute without output encoding, and the popovers are configured with data-html="true", allowing injected markup to execute in the victim's session.