CVE Vulnerability Catalog

BuildKit on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. An untrusted user building an image on a WCOW-configured BuildKit daemon can read arbitrary host files reachable to the daemon process.

FileCodeBox before version 2.4 has a rate-limit bypass vulnerability in the IPRateLimit class. An unauthenticated attacker can supply controlled X-Real-IP and X-Forwarded-For headers without trusted reverse proxy verification, allowing enumeration of share codes and retrieval of other users' files.

Vulnerability in Net::DNS for Perl up to version 1.55. Allows DoS via deep DNS compression pointer chains. The decode function recursively processes pointers without depth limit, potentially overflowing the stack and causing SIGSEGV.

Cookie injection vulnerability in Adminer before version 5.4.3. Attackers can manipulate cookie attributes via unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. This can downgrade SameSite protection and enable cross-origin authenticated requests.

Glance through version 0.8.5 has an IP address spoofing vulnerability in the authentication handler. An unauthenticated attacker can bypass brute-force lockout protections by supplying arbitrary values in the X-Forwarded-For header when the server proxied option is enabled. Each login attempt appears to come from a different IP, preventing lockout and allowing unlimited password guessing.

SSRF vulnerability in Huginn through 2022.08.18 in the fetch_url method of ScenarioImport allows authenticated users to make arbitrary HTTP requests by submitting crafted URLs. The attack can be used to scan internal services and access cloud metadata.

SSRF vulnerability in HyperDX before version 2.31.0. Authenticated team members can direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint, without URL validation or allowlist. Attackers can exploit error responses to disclose internal service responses.

Roo Code through 3.54.0 has a command injection vulnerability in the auto-approve execute feature. Attackers can bypass allowlist/denylist by nesting command substitutions inside parameter expansion defaults, allowing arbitrary command execution.

LimeSurvey up to versions 6.17.10 and 7.0.4 contains an SSRF vulnerability in the REST API survey template endpoint. Authenticated users can manipulate the Host header, causing the server to issue arbitrary HTTP requests, enabling access to internal network services and cloud metadata endpoints.

Broken access control vulnerability in Joomla extension Quix Page Builder before version 6.2.1. Authenticated users can upload media files regardless of their media management permissions.

Authenticated Stored XSS vulnerability in Quix Page Builder for Joomla (versions < 6.2.1). An authenticated builder user can inject scripts that execute for any visitor, due to unescaped output and unsanitized SVG.

Path traversal and file read vulnerability in Quix Page Builder for Joomla (versions < 6.2.1). Unauthenticated users can exploit form elements to read arbitrary files on the server.

The Joomla extension Quix Page Builder Pro below version 6.2.1 allows an authenticated user with core.create/core.edit permissions to inject PHP code into element content. This code is executed via the include() function when the view is cached (caching is enabled by default).

DNG SDK versions 1.7.1 2536 and earlier are affected by a stack-based buffer overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction – opening a malicious file.

All versions of IdentityIQ are vulnerable to unauthorized access to protected APIs and data due to improper validation of OAuth bearer tokens. An unauthenticated attacker can exploit this.

Vulnerability in ExtremeXOS (EXOS) – mv, cp, rm commands unsafely handle symbolic links, allowing an attacker with low privileges to access files outside the allowed scope. This can lead to root privilege escalation and persistent software modification.

ExtremeXOS (EXOS) uses an insufficiently random source to generate challenge values for debug-mode authentication. This allows predicting the response and activating debug-mode without authorization, potentially leading to root-level access and persistent software modification.

The libcupsfilters and cups-filters libraries lack an error recovery handler when reading PNG files. An attacker can send a crafted PNG print job, causing the print job processing to abort.

xrdp versions up to 0.10.6 launch Xvnc over UNIX sockets with insufficient authentication. A local authenticated attacker can bypass session isolation and unauthorizedly view or control other users' sessions. Only the Xvnc backend over UNIX sockets is affected.

Vulnerability in FreeScout (versions prior to 1.8.221) in the attachment download mechanism. An unauthenticated attacker can download any attachment created by an older version because token authentication is skipped for attachments with legacy token type.