CVE Vulnerability Catalog

Backstage prior to 1.54.6 does not consistently enforce credential boundaries in scaffolder source-control actions. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.

In @backstage/plugin-scaffolder-backend prior to 4.1.0, incorrect authorization in scaffolder task listing allows an authenticated internal user to view metadata for tasks outside the intended visibility. Stored task secrets are not included, and no integrity or availability impact was identified. Fixed in version 4.1.0.

In @backstage/plugin-auth-node from 0.3.0 to 0.6.15 and 0.7.5, explicit negative email verification was not consistently honored during shared OAuth profile normalization. In affected configurations, a user may assume another catalog identity and obtain its associated access and permissions. Fixed in versions 0.6.15 and 0.7.5.

In @backstage/plugin-catalog-backend-module-bitbucket-server from 0.4.0 to 0.5.15, inconsistent repository filtering in Bitbucket Server catalog event updates may allow ingestion of locations from repositories excluded by filters. Fixed in version 0.5.15.

In @backstage/plugin-auth-backend-module-cloudflare-access-provider from 0.1.0 to 0.5.0, insufficient audience validation in the Cloudflare Access auth provider allows a user with a valid token for another Access application to authenticate to Backstage. Fixed in version 0.5.0.

In @backstage/plugin-proxy-backend from 0.5.0 to 0.6.18, inconsistent credential enforcement for overlapping proxy routes allows an unauthenticated caller to reach a nested upstream. Fixed in version 0.6.18.

In Amazon Bedrock AgentCore Starter Toolkit before 0.3.14, server-side request forgery in OpenAPI schema processing of the agent import functionality might allow an authenticated remote actor to cause arbitrary outbound requests and read arbitrary local files. Fixed in version 0.3.14; migration to @aws/agentcore is recommended.

In the optional Amazon Q Business Lambda hook sample (q-business-lambda-hook) available with QnABot on AWS versions 7.0.0 through 7.4.5, an authorization bypass through a user-controlled key might allow an authenticated remote user to read arbitrary S3 objects. Fixed in version 7.4.6, but requires redeployment of the hook stack.

In SSSD (System Security Services Daemon), a flaw exists where pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing unbounded memory consumption, potentially leading to DoS.

In SSSD, a race condition in the autofs responder between asynchronous enumeration completion and map invalidation can be exploited by a local user to cause memory leaks, leading to excessive memory consumption that can disrupt or crash the autofs service.

When a private repository is transferred to a user without access, Gitea grants temporary read access as a collaborator. Rejecting or cancelling the transfer did not revoke this collaboration, so the recipient kept persistent read access to the private repository, including code, issues, pull requests, and wiki, and could clone it. The repository owner was not notified. Transfer-granted access is now removed while pre-existing collaborations are preserved.

With `[migrations] ALLOWED_DOMAINS` set to a matching entry such as `*` or a hostname wildcard, Gitea's migration URL validation could permit reserved and link-local addresses, such as `169.254.169.254`, even when `ALLOW_LOCALNETWORKS = false`. The local-network block list did not cover these ranges, and a hostname matching the allow list was accepted regardless of its resolved address. A user who can start migrations on such an instance could reach these addresses from the Gitea server; the default empty `ALLOWED_DOMAINS` configuration is not affected.

When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown link, giving processing time quadratic in the input size. An authenticated user able to submit issue or comment content could send a crafted body of about 1 MB that keeps a CPU core busy for several minutes while holding a database transaction open.

In Apache Commons BCEL before 6.13.0, there is an issue with symbolic name mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.

A vulnerability in an API interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to obtain sensitive information from the affected system.

A sensitive information disclosure vulnerability exists in the client software of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an attacker with local access to the affected system to obtain sensitive information.

A vulnerability in a client interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a DOM-based cross-site scripting (XSS) attack against a user of the affected client interface. Successful exploitation could allow an attacker to execute arbitrary script code in a victim's browser context.

A command injection vulnerability in the OnGuard agent of ClearPass Policy Manager could allow an authenticated remote attacker to inject arbitrary commands. Successful exploitation could allow an attacker to execute commands with elevated privileges on the affected Windows endpoint.

An arbitrary file write vulnerability in the ClearPass Policy Manager OnGuard agent could allow malicious users on a local instance to elevate their user privileges if certain preconditions outside of the attacker's control are met. Successful exploitation could allow a local attacker to execute arbitrary code with elevated privileges.

A local privilege escalation vulnerability exists in the ClearPass client software. Successful exploitation could allow a low-privileged local user to execute commands with elevated privileges on the affected system, if certain conditions outside of the attacker's control are met.