CVE Vulnerability Catalog

Anki prior to version 25.09.3 runs a local HTTP server that does not sufficiently block requests from other origins. A malicious website could send requests to this server, potentially causing side effects.

The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.

A vulnerability in Dashy before version 4.3.7 allows JavaScript execution in the application's origin context by passing a malicious URL in the 'url' parameter of the workspace view. An attacker can exploit this to steal browser data, manipulate the DOM, or send requests on behalf of the victim.

A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function has an inverted boolean condition, accepting SDP offers without the required a=fingerprint attribute and rejecting those with it. An attacker can manipulate WebRTC signaling to bypass DTLS certificate fingerprint binding.

A vulnerability was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies even when the incoming request carries unrelated cookies, allowing remote attackers to read private data from the shared cache.

In Coolify prior to version 4.0.0-beta.474, database credential fields (redis_password, keydb_password, dragonfly_password, clickhouse_admin_user, clickhouse_admin_password, postgres_user, mysql_user) are validated only as 'string' with no shell-safety checks. These values are then interpolated directly into Docker Compose YAML command strings without any escaping, allowing command injection.

An uncaught exception in the diagnostic web interface of Controller 6000 and Controller 7000 allows an authenticated and authorized operator to trigger a controller restart by sending specific requests, resulting in a temporary denial of service.

An uncaught exception in T20 Readers allows an authenticated and authorized operator to trigger a restart by sending specific requests, resulting in a temporary denial of service. The vulnerability affects Command Centre versions 9.50, 9.40, 9.30, 9.20, and all earlier versions.

In Coolify prior to version 4.0.0-beta.474, Sanctum API tokens did not expire, meaning a leaked token retained access indefinitely until manually revoked. This vulnerability is fixed in version 4.0.0-beta.474.

In Coolify prior to version 4.0.0-beta.474, the file upload endpoint for database backup restore did not enforce file type or size validation. This allowed an authenticated user to upload unexpected or oversized files that could affect service availability.

Coolify prior to version 4.0.0-beta.471 contains a command injection vulnerability in the DatabaseBackupJob function. An authenticated user with database management permissions can execute arbitrary commands on managed servers by manipulating database credentials or MongoDB collection exclusion names.

FOSSBilling prior to version 0.8.0 contains a vulnerability where low-privileged staff accounts can read sensitive data via admin API endpoints lacking permission checks. Write endpoints correctly enforce fine-grained permissions, but the corresponding read endpoints have no authorization guards.

In FOSSBilling versions prior to 0.8.0, the PayPalEmail payment adapter accepts PayPal IPN callbacks and credits the IPN-supplied amount (`mc_gross`) to the client's balance without validating it against the invoice total. Combined with a $0.05 floating-point epsilon tolerance in the invoice credit-payment logic, this allows a client to underpay an invoice by up to $0.04 and still have it marked as fully paid.

A vulnerability in Coolify prior to version 4.0.0-beta.474 allows arbitrary command execution on the server due to missing shell escaping in the buildHelperImage method. An attacker can set the dev_helper_version field and trigger the helper image build in a development environment.

In Coolify from version 4.0.0-beta.451 through 4.0.0-beta.470, database backup handling for MongoDB collection names did not fully validate shell metacharacters, allowing a highly privileged attacker who can configure backup inputs to inject commands. This issue is fixed in version 4.0.0-beta.471.

A 32-bit integer overflow vulnerability exists in the AES-GCM implementation of the OP-TEE core. After processing more than 512 megabytes of payload or Additional Authenticated Data (AAD), the authentication tag is computed with incorrect bit-length values.

In OP-TEE from version 3.3.0 to 4.10.0, a resource leak exists in the `cleanup_shm_refs()` function due to missing bitmask application on parameter attributes. This skips the `mobj_put()` call for non-contiguous memory parameters, causing a persistent leak of `mobj_reg_shm` objects and exhaustion of the secure-world heap.

The RSA PKCS#1 v1.5 implementation in the Hisilicon HPRE crypto driver in OP-TEE is vulnerable to a Bleichenbacher-style attack. Non-constant-time `memcmp()` and distinguishable error paths allow an attacker to recover plaintext.

The RSA-OAEP decryption in the NXP CAAM crypto driver for OP-TEE (versions 3.9.0 to 4.10.0) uses non-constant-time `memcmp()` for label hash verification and has distinguishable error paths. This allows an attacker to recover RSA-OAEP plaintext with approximately 1000-2000 adaptive chosen ciphertext queries via a Manger-style padding oracle.

The RSA-OAEP implementation in the Hisilicon HPRE crypto driver in OP-TEE is vulnerable to a padding oracle attack. Non-constant-time memcmp() for label hash verification and distinguishable error paths allow plaintext recovery with approximately 1000-2000 adaptive chosen ciphertext queries.