CVE Vulnerability Catalog

jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delete other users' business objects by submitting direct object identifiers without authorization checks.

jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and access all business records in the tenant.

jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuration. Attackers can rewrite or delete tenant-wide settings covering company identity, stock rules, approval behavior, and printing configuration through the systemConfig endpoint.

jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to reset any other user's password. Attackers can submit a request with an arbitrary target user ID to reset that account's password to a known default value.

jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbitrary roles. Attackers can send a POST request with type=UserRole, their own user ID, and a role ID list to escalate from low-privilege tenant user to tenant administrator.

A weakness has been identified in ColorFul iGameCenter 1.0.3.4, affecting the function sub_140001AF0 in the ene.sys library of the IOCTL Handler component. This manipulation causes an untrusted pointer dereference. The attack can only be executed locally, and the exploit has been made publicly available.

Warpgate, an open source SSH, HTTPS and MySQL bastion host for Linux, prior to 0.25.6 has a vulnerability in api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs. The endpoint /@warpgate/admin/api/recordings/{uuid}/stream is protected only by session authentication, omitting require_admin_permission for AdminPermission::RecordingsView. Any authenticated regular user who identifies an active recording can subscribe to its WebSocket and receive real-time terminal input and output from proxied SSH, MySQL, or PostgreSQL sessions, including credentials and commands.

Dell Command Powershell Provider (DCPP), versions prior to 2.10.2, contain an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.

The Time-aware GPIO driver in Zephyr OS lacks validation of output pointers in the tgpio_pin_read_ts_ec() syscall, allowing an unprivileged thread to write to arbitrary kernel memory. The vulnerability only affects builds with CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y, and practical exposure is limited by build issues in some versions.

Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. This occurs in button.text.toUtf8 in export_output_html.cpp. Exploitation cannot occur unless HTML export was used by a victim, but the exploit payload can be exported if a message were forwarded into a group by a member.

KubeEdge, an open source system for extending native containerized application orchestration capabilities to hosts at Edge, from 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, has a vulnerability in the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go. The function joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory.

KubeEdge, an open source system for extending native containerized application orchestration capabilities to hosts at Edge, from 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, has a vulnerability in ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go. Authenticated user-controlled updateFields values are concatenated into the keadm config-update command and executed through a system shell. A user with permission to create or modify ConfigUpdateJob resources can include shell metacharacters in the complete --set value and cause arbitrary commands to execute on an enrolled target edge node with the privileges of the KubeEdge process handling the job.

HomeBox, a home inventory and organization system, prior to 0.26.0 has a vulnerability in NotifierRepository.Update in backend/internal/data/repo/repo_notifier.go. The function updates a notifier through UpdateOneID(id) without requiring the record's user ID to match the authenticated user. An authenticated user who supplies another tenant's notifier UUID to PUT /v1/notifiers/{id} can read the returned stored url, which may contain plaintext Shoutrrr credentials for Slack, SMTP, Telegram, Pushover, or Discord, and can replace the URL to redirect the victim's notifications to an attacker-controlled webhook.

HomeBox, a home inventory and organization system, prior to 0.26.0 has a vulnerability in MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/internal/data/repo/repo_maintenance_entry.go. The functions use UpdateOneID(id) and DeleteOneID(id) without verifying that the maintenance entry belongs to the authenticated user's active group. An authenticated low-privileged user who knows or enumerates another tenant's maintenance-entry UUID can overwrite that record or permanently delete it.

HomeBox, a home inventory and organization system, prior to 0.26.0 has a vulnerability in HandleWipeInventory in backend/app/api/handlers/v1/v1_ctrl_actions.go. The function authorizes POST /v1/actions/wipe-inventory through the global ctx.User.IsOwner value instead of the caller's role in the active group, while the active group is selected through the X-Tenant request header. Because every self-registered user who creates a group receives the global owner value, a user who is also a member of another group can select that group with X-Tenant and permanently delete its complete inventory, which is not recoverable without external backups.

A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects after each request. This causes a steady increase in memory usage that eventually leads to the application slowing down and crashing due to lack of memory.

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua and scripts/lua/rest/v2/get/system/configurations/download_backup.lua allow any authenticated non-admin user to list and download system-configuration backups without an administrator check. The download path reaches backup_config.export_backup, and prefs_dump_utils.build_prefs_dump_table includes the ntopng.user.* Redis key space in the backup. A downloaded backup can therefore disclose password hashes for local users and, when configured, API tokens, TOTP secrets, and WebAuthn credential data, enabling account compromise through usable or recoverable credentials. This issue is fixed in version 6.7.260718.

In ntopng prior to 6.7.260717, the POST /lua/rest/v2/edit/system/edit_blacklist.lua endpoint lacks an administrator check and calls lists_utils.editList for any authenticated user. The list_name, list_enabled, url, and list_update parameters allow a non-admin user to redirect threat-intelligence downloads to attacker-controlled content, disable blocklists, or prevent scheduled updates.

In Tinyauth prior to 5.1.2, forwarded hostnames are compared case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app access controls with a differently cased hostname. The lookup can miss the configured app and return an empty access-control object, which is then treated as permissive.

In draw.io prior to 30.3.8, Utils.sanitizeUrl() checks IPv6 Unique Local Addresses by comparing text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the fc00::/7 range, including the AWS metadata range fd00:ec2::/32, is not blocked. An unauthenticated request to /embed2.js?fetch= can make the server fetch an IPv6 ULA internal resource and reflect the response to the requester.