CVE Vulnerability Catalog

SSRF vulnerability in LMDeploy up to version 0.14.0 (fixed in commit 03c3130) in the _load_http_url function in connection.py. The private-IP guard only validates the original URL without re-validating hosts after HTTP redirects.

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes them directly to PHP's 'chmod()' function via 'octdec()' conversion without validation. An authenticated user with 'chmod' permission can escalate privileges to root.

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana allows unauthorized information disclosure and compromise of case attachment integrity. A low-privileged authenticated user can read, modify, and delete case attachments they are not authorized to access, including those related to Security Solution.

SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java file.

An issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file.

Shelf prior to version 1.20.2 has an IDOR vulnerability that allows an authenticated user from organization A to access data of organization B by manipulating entity IDs. Additionally, booking restrictions can be bypassed via a crafted POST request.

Vulnerability in CC: Tweaked mod for Minecraft. Prior to version 1.119.0, the HTTP API blocks requests to private network ranges to prevent SSRF. This protection can be bypassed on IPv6-capable servers using NAT64 prefix addresses (`64:ff9b::/96`). An attacker executing Lua code can reach internal IPv4 services by addressing them as `http://[64:ff9b::<ipv4-as-hex>]/`. Affects deployments on networks with NAT64 routing, standard on AWS, GCP, etc. Version 1.119.0 fixes the issue.

Vulnerability in the MeltanoHub repository (source code of hub.meltano.com) prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173. A dangerous CI/CD workflow (pull_request_target) allowed exfiltration of a GITHUB_TOKEN with write permissions.

Vulnerability in FOG (imaging/inventory management system). An unauthenticated attacker can remotely wipe AES keys and delete power management tasks via a single HTTP GET request.

XSS vulnerability in FOG (open-source cloning/imaging tool) allows an unauthenticated attacker who knows a host's MAC address to inject malicious JavaScript via the sysproduct parameter. The payload executes in the admin's browser when viewing inventory reports.

Vulnerability in FOG, a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inventory service endpoint (`/service/inventory.php`) persists client-supplied values without sanitization, and the Host Management Inventory page renders static inventory fields without output encoding, allowing stored XSS in any administrator's browser.

Vulnerability in Kubeflow Community Distribution before version 26.03-rc.1 allows stealing authorization tokens from users with kubeflow-edit role, leading to account takeover.

Command injection vulnerability in the command line interface of ECOS devices. A highly privileged, authenticated remote attacker can execute arbitrary commands on the underlying operating system.

Vulnerability in the web-based management interface of an ECOS device. Allows a highly privileged, authenticated remote attacker to access the device's filesystem.

Directory traversal vulnerability in knowns-dev/knowns 0.11.4. An attacker can use a crafted path in the get_doc and update_doc tools to access files outside the intended directory.

The application contains an SQL injection vulnerability in report filtering parameters. Unsanitized user input is concatenated directly into SQL queries, enabling blind SQL injection and unauthorized database read access.

Vulnerability in the Data::SpatialHash::Shared library for Perl before version 0.02 allows out-of-bounds reads and writes. A local attacker who can write to the backing file can manipulate indices, leading to memory corruption or process crash.

The norm.Iter function can enter an infinite loop when processing input containing invalid UTF-8 bytes.

An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/{instance_id} endpoints with no authentication.

Cross Site Scripting vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to execute arbitrary code via the mcp parameter.