CVE Vulnerability Catalog

In Plane prior to 1.4.0, multiple issue-listing endpoints, including unauthenticated public deploy boards, pass the user-controlled order_by parameter to Django's order_by without allowlist validation. An attacker can use double-underscore relationship traversal to reference arbitrary related model fields, revealing database schema details through errors and potentially disclosing field values through differential ordering. Fixed in version 1.4.0.

A vulnerability in Plane before version 1.4.0 involves failure to sanitize unsafe URL schemes in comments (comment_html). A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser of another user who clicks the link. The issue is fixed in version 1.4.0.

In self-hosted Plane deployments prior to 1.4.0, unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/ through WorkspaceJoinEndpoint expose the secret invitation token directly and through get_invite_link. An external attacker can retrieve a token intended for another user and submit it to the invitation acceptance flow, joining the workspace without receiving the invitation and gaining the role assigned to the invite. Fixed in version 1.4.0.

In JupyterLab from 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to resolve the current document rather than retaining the document whose command button was clicked. If another document becomes current while the prompt is open and the user chooses Trust, JupyterLab marks the second document trusted while leaving the clicked document untrusted. Later command buttons in the incorrectly trusted document run without a prompt, and trusting a notebook marks all cells trusted, saves unsaved edits, and persists the server signature to disk. Fixed in versions 4.5.11 and 4.6.4.

asteval, a Python expression evaluator for restricted execution, prior to 1.0.9 allows sandbox escape. With numpy enabled, the default Interpreter exposes a ctypes type and permits from_address memory access, while attribute assignments use unfiltered setattr. An attacker-controlled expression can read or corrupt process memory, execute code, or disclose secrets.

The vulnerability in Xen concerns the GNTTABOP_cache_flush operation, which may be issued on memory mapped from another domain using the grant table interface. There was no restriction to disallow the use of invalidate-without-clean against read-only grant mappings, which may corrupt the granted memory.

The vulnerability in Xen concerns the GNTTAB_cache_flush operation, where the error path after adding a NULL check fails to drop a page reference if the page is owned by a special system domain (DOM_IO or DOM_COW).

The vulnerability in Xen concerns the GNTTABOP_cache_flush operation, where the fix for XSA-437 introduced a calculation that may underflow, resulting in a loop that would take excessively long, potentially crashing the hypervisor, especially on 64-bit Arm.

Electron applications on macOS using Squirrel.Mac-based automatic updates are vulnerable to a local race in the privileged ShipIt helper prior to 39.8.10, 41.10.5, and 42.0.0-beta.2. The helper did not bind the validated update target to one canonical application-bundle path, allowing a local attacker to redirect the root-level write and overwrite another application's files.

Axios versions 1.15.0 through 1.20.0 incorrectly treat NO_PROXY CIDR entries as textual hostname suffixes instead of network ranges. A request to an address covered by a CIDR entry in NO_PROXY is not matched and is sent through the configured proxy. For plaintext HTTP the proxy can observe and modify URLs, headers, and bodies; for HTTPS it can observe connection metadata and CONNECT requests.

The vulnerability in ProPhoenix Law RMS version v2022.2403.3.101 is a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Alert/MsgType parameter in the errorHandler.aspx endpoint.

An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId cookie.

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request.

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Notes parameter in the Notes.aspx endpoint.

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.

Listed NETGEAR router models have insufficient input validation in the time server (NTP) setting. An attacker connected to the router's local network with administrator credentials can run unauthorized commands on the router. This impacts router integrity, with no impact on confidentiality or availability.

A vulnerability in the network messaging layer of Commvault involves improper handling of highly compressed data affecting service availability. Customers are advised to upgrade to the resolved maintenance release.

A vulnerability in QAPI (part of Commvault) involves a stack-based buffer overflow affecting service availability. Customers are advised to upgrade to the resolved maintenance release.

An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c

Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size mismatch between its bundled load_ini_buffer utility and strip_ini_cache()