CVE Vulnerability Catalog

A vulnerability was found in PickMall Lilishop up to 4.2.4 in /buyer/trade/receipt within the Buyer Invoice List component. Manipulation of the memberId argument leads to authorization bypass. The attack can be launched remotely and the exploit has been disclosed to the public.

A vulnerability was found in yogeshojha reNgine up to 2.2.0 in the subdomain_discovery function of web/reNgine/tasks.py within the listTargets Endpoint component. Manipulation of the Name argument results in OS command injection. The attack can be launched remotely and the exploit has been made public.

In Punk versions from 0.48 before 0.55 for Perl, Extended CONNECT requests are routed to any GET route without an Origin check in ps_serve_one. On HTTP/2 and HTTP/3 a WebSocket handshake arrives as an Extended CONNECT, which is matched as a GET and so reaches every GET route, API operation and mount. The Origin check runs only when a websocket route matches. On this transport the handler's status is the handshake response, and a 2xx accepts it. A cross-origin page can open a WebSocket to any path and learn from its open or error event whether that path returns 2xx.

A flaw was found in SSSD due to a missing state validation check in passkey Kerberos handling. A local attacker can send a specially crafted PAM request when passkey authentication is enabled, causing the PAM responder to dereference an uninitialized pointer and crash.

A flaw was found in SSSD where a local attacker with access to the NSS responder UNIX socket can trigger an integer underflow by sending a specially crafted request with an undersized packet header. This causes an out-of-bounds memory read during packet parsing, crashing the responder process.

A flaw was found in SSSD due to missing input validation in the PAM responder. A local attacker can send a crafted PAM request containing a zero-length authentication token, causing the service to read beyond buffer boundaries and crash the PAM responder.

A flaw was found in SSSD's NSS responder negative cache. An unprivileged local user can repeatedly request lookups for nonexistent entries, causing the cache to grow without bound because it does not limit the total number of stored entries.

A flaw was found in SSSD's GSSAPI authentication handling in the PAM responder, where cached connection state is freed without clearing the reference pointer. A local user can send an additional request over the same connection, causing the service to access invalid memory and terminate unexpectedly.

A flaw was found in SSSD where, in LDAP environments configured to evaluate password expiration warnings before restrictive access rules, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote authenticated user with an expired password using an alternative authentication method can bypass access control restrictions.

A SQL injection vulnerability was identified in girishsaraf Online-Appointment-Booking-System in the book.php file of the Booking Handler component. Manipulation of the Doctor/appointment argument allows remote attacks, and the exploit has been made publicly available.

A flaw was found in SSSD where the service fails to verify the presence of the SID extension before processing it in deployments configured with SID-based certificate mapping rules. A remote attacker can submit a certificate lacking the expected SID extension, causing the process to crash during authentication or lookup operations.

A flaw was found in SSSD where a local attacker can send a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process.

The NFS idmap plugin in SSSD fails to abort after detecting that a cached entry exceeds the destination buffer size, leading to an out-of-bounds write. A local attacker can trigger this by requesting identity lookups that resolve to oversized cached entries, causing a crash of the identity mapping service (DoS) and potential corruption of adjacent process memory.

In the Kerberos Credential Manager (KCM) responder in SSSD, the service fails to release cached objects from memory when credentials are removed. A local user can maintain a persistent connection and repeatedly store and destroy credentials, causing continuous memory growth and ultimately exhausting available memory, rendering the service unresponsive (DoS).

A use-after-free vulnerability exists in the Kerberos Credential Manager (KCM) responder in SSSD during Kerberos ticket-granting ticket (TGT) renewal, where a deferred callback accesses memory that has already been released. An authenticated local user with a renewable Kerberos ticket can trigger this issue, causing the KCM responder service to crash and resulting in a Denial of Service (DoS).

In SSSD, when configured to enforce account expiration using LDAP shadow attributes, an expiration value of zero is not treated as an expired account. A user with valid credentials for an expired account can exploit this flaw to bypass access controls and authenticate to the system, allowing unauthorized access after the account was intended to be deactivated.

In SSSD, an unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing authorization checks. This triggers global cache invalidation and forces repeated lookups to backend directory providers, leading to a Denial of Service (DoS) from degraded automount availability and elevated resource consumption.

In SSSD, when the autofs responder service is enabled, memory allocated during successful request processing is not released until the client connection terminates. A local attacker can exploit this by maintaining an open connection and repeatedly submitting valid requests, leading to memory exhaustion and a Denial of Service (DoS).

Joplin Server prior to 3.7.2 stores CSRF, account-confirmation, email-change, and password-reset tokens without a purpose, and UserModel.resetPassword accepts any token returned by TokenModel.userFromToken. An attacker who obtains a victim's CSRF or confirmation token through a separate disclosure channel can submit it to the public password-reset endpoint, replace the victim's password, and cause the existing sessions and API applications to be deleted. This issue is fixed in Joplin Server 3.7.2.

In Joplin prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components to render card content with the full Markdown renderer, and the components insert the resulting HTML into the main application document through dangerouslySetInnerHTML. A malicious note can inject style elements and remote CSS imports that modify trusted application chrome, signal when the note is opened, and potentially disclose exposed attribute values. Content Security Policy blocks inline script execution, so the supported impact is CSS injection and UI redressing rather than code execution. This issue is fixed in version 3.7.13.