CVE Vulnerability Catalog

OpenList, a file list program that supports multiple storage, prior to 4.2.4 contains a vulnerability where share creation and update checks use strings.HasPrefix(requested_path, user.BasePath) without enforcing a directory separator boundary. An authenticated user with CanShare permission and a BasePath such as /base can submit a sibling path such as /base2/secret.txt, create a share for the out-of-scope file, and use the public share download or list handlers to read data outside the assigned directory. This issue is fixed in version 4.2.4.

MobSF, a mobile application security testing tool, prior to 4.5.1 contains a vulnerability in the unzip function in mobsf/StaticAnalyzer/views/common/shared_func.py that logs that an archive member exceeding ZIP_MAX_UNCOMPRESSED_FILE_SIZE is being skipped but does not continue to the next member. An authenticated user can upload a crafted ZIP or APK whose oversized member is extracted to disk when the aggregate ZIP_MAX_UNCOMPRESSED_TOTAL_SIZE limit has not yet been reached, potentially exhausting disk space and preventing further scans. This issue is fixed in version 4.5.1.

MobSF, a mobile application security testing tool, prior to 4.5.1 contains a vulnerability where django.middleware.csrf.CsrfViewMiddleware is placed only in the deprecated MIDDLEWARE_CLASSES setting and omitted from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim submit cross-site POST requests to authenticated web endpoints including /delete_scan/, /upload/, /download_scan/, /change_password/, /create_user/, and /delete_user/. This can delete scans, upload or download applications, change passwords, or manage users with the victim account permissions. This issue is fixed in version 4.5.1.

MobSF, a mobile application security testing tool, prior to 4.5.1 contains a vulnerability in find_icon_path_zip in mobsf/StaticAnalyzer/views/android/icon_analysis.py that uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containment. An authenticated user can upload a crafted ZIP or APK that reads a server file with an ALLOWED_EXTENSIONS suffix, copies it to DWD_DIR as the predictable name -icon., and retrieves it through the /download/ endpoint. The same behavior provides a file-existence oracle through the icon_path report field. This issue is fixed in version 4.5.1.

MagicMirror², an open source modular smart mirror platform, prior to 2.37.0 contains a vulnerability in the ADD_CALENDAR handler in defaultmodules/calendar/node_helper.js that accepts an attacker-controlled URL, authentication data, and selfSignedCert setting through the unauthenticated Socket.IO namespace /calendar. The handler passes these fields to CalendarFetcher, causing a server-side request without SSRF validation and optionally disabling TLS verification. When the response is valid iCal, CALENDAR_EVENTS returns parsed event data to the attacker, allowing internal-service response data to be exfiltrated; other responses still provide a blind request and timing primitive. This issue is fixed in version 2.37.0.

MagicMirror², an open source modular smart mirror platform, prior to 2.37.0 contains a vulnerability in checkArticleUrl in defaultmodules/newsfeed/node_helper.js that accepts the CHECK_ARTICLE_URL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetch(url, { method: "HEAD" }) without validating the attacker-controlled URL. The helper returns ARTICLE_URL_STATUS containing the URL and framing result, providing a response and timing oracle that can identify internal hosts and ports and trigger side effects on services that react to HEAD requests. This issue is fixed in version 2.37.0.

MagicMirror², an open source modular smart mirror platform, prior to 2.37.0 contains a vulnerability when hideConfigSecrets is enabled. The catch-all socket dispatcher in js/node_helper.js passes every inbound object payload through replaceSecretPlaceholder in js/server_functions.js before invoking socketNotificationReceived. A client connected to a loaded module namespace can submit a SECRET_API_KEY placeholder, causing the server to replace it with the corresponding process environment value. The default weather helper accepts INIT_WEATHER, copies the attacker-controlled instanceId, and returns it in WEATHER_ERROR, providing an echo path for the expanded secret. This reverses the intended one-way redaction boundary and can disclose API tokens, credentials, or service keys stored in SECRET_ variables. This issue is fixed in version 2.37.0.

Forem before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c stores an unsanitized value from feedback_message[message] and renders it via raw() in the admin view when offender_id is present. Viewing the abuse report executes arbitrary JavaScript in an administrator's browser, potentially exposing sensitive in-page data, CSRF tokens, or performing administrative actions. The public FeedbackMessagesController accepts the report without authorization and previously allowed a submitted offender_id, making the vulnerable path reachable by an unauthenticated attacker.

AngleSharp before 1.5.0 does not treat MathAnnotationXmlElement as an HTML integration point when its encoding attribute is text/html or application/xhtml+xml, causing tokens to be routed through foreign-content parsing instead of HTML parsing. A sanitizer can observe a different DOM from the browser that reparses the serialized output. An attacker can combine this namespace differential with markup-breaking characters in an attribute value so that an element hidden from the sanitizer becomes active script-capable HTML after browser reparse, resulting in mutation cross-site scripting.

aiosmtplib before 5.1.1 does not reject addresses containing CR or LF bytes in SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), and SMTP.expn(). Data after the line break is framed as additional standalone SMTP command lines, allowing an attacker to inject commands such as MAIL FROM, RCPT TO, RSET, DATA, or AUTH. SMTP.sendmail() and SMTP.send() without a Message object pass addresses through the affected methods, while SMTP.send_message() is not affected. Successful injection can desynchronize the command-response pipeline, hang the SMTP instance, or send an arbitrary message without requiring attacker control of the SMTP server.

A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the reportico_criteria parameter in conjunction with the execute_mode=CRITERIA parameter of run.php.

A directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to expose or execute arbitrary PHP files on the web server by specifying the filename in the target_format parameter in conjunction with the execute_mode=EXECUTE parameter of the run.php endpoint.

Kurrier before 1.2.4 did not enforce ownership checks for authenticated API requests in endpoints for listing and retrieving webhook and identity resources. An attacker with a valid API key could use another account's identifiers to read and enumerate webhook and identity resources belonging to that account. Anonymous requests and invalid API keys were rejected, and cross-user modification operations were blocked, but affected GET and list operations could expose another user's resource metadata.

WeasyPrint before 69.0 embeds unescaped HTML presentational-hint attribute values into CSS in weasyprint/css/__init__.py when presentational_hints=True. The background attribute is inserted into a background-image:url() declaration and parsed by tinycss2.parse_blocks_contents(), allowing untrusted HTML to inject additional CSS declarations. Applications that render untrusted HTML with presentational hints enabled can be affected by CSS injection and server-side requests through injected url() values.

Joomla! Core has an improper ACL check when injecting schema.org contact data. This allows contact information for inaccessible contact items to be injected into schema.org snippets.

Joomla! Core has an XSS vulnerability through schema.org outputs. Improper escaping flags lead to an XSS vector in schema.org markup outputs.

Joomla! Core has an improper ACL check for custom fields webservice endpoints. Unauthorized users can create fields for inaccessible components.

Joomla! Core has an improper CORS origin validation. An improper implementation prevented configured CORS origins from being properly validated in CORS requests.

Joomla! Core has a response header injection vulnerability in download views. Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-type confusion.

A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPsec pre-shared key (PSK) in an unencrypted format. This key, which is critical for securing communication between Kubernetes clusters, can be accessed by unauthorized parties. Such access enables an attacker to passively decrypt network traffic flowing between any two clusters in the mesh, resulting in sensitive information disclosure.