CVE Vulnerability Catalog

The RepairBuddy plugin for WordPress (computer-repair-shop) is vulnerable to stored XSS due to improper neutralization of input during web page generation. This affects versions from n/a through 4.1225.

The Dockerfile frontend loaded Dockerfile and .dockerignore files into memory without a size limit. A build context with an oversized file could cause buildkitd to allocate memory proportional to the file size, potentially exhausting memory and terminating the daemon, interrupting other builds.

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.

BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access.

A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic.

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity.

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. The Windows.Sysinternals.SysmonLogForward artifact allows the user to specify an arbitrary binary path as a parameter and did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions to run a different binary program than the installed sysmon binary.

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server metadata, which is often used to store site-wide configuration data that should only be updated by the server admin.

The Image Slider Widget plugin for WordPress (image-slider-widget) is vulnerable to stored XSS due to improper neutralization of input during web page generation. This affects versions from n/a through 1.1.130.

A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting (XSS). Because the application does not validate the redirect destination before navigating, this flaw allows the execution of arbitrary script in the context of the victim's authenticated browser session. Successful exploitation requires the target Quay deployment to use direct database authentication and the victim to complete login through the malicious URL.

A cross-site scripting (XSS) vulnerability was found in Quay's OAuth callback handler. By tricking a logged-in user into visiting a specially crafted link, an attacker can execute arbitrary JavaScript in the user's browser session due to improper input sanitization.

Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks API permissions against the caller's Org instead of the requested Org. This allows a user with API access in one org to read events from another org for which they have no access.

Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can add issues from any workspace to a cycle they control. If a victim issue is already assigned to a cycle, the operation removes it from the victim's cycle, causing a destructive cross-tenant write. This issue is fixed in 1.4.0.

Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/ accept body- or URL-supplied issue IDs and operate on them without checking that the IDs belong to the caller's workspace and project. The permission decorator on each endpoint validates only that the caller is a member or administrator of the workspace and project named in the URL. BulkDeleteIssuesEndpoint can destroy CycleIssue and ModuleIssue associations belonging to foreign issues. SubIssuesEndpoint can re-parent foreign issues under an attacker-selected issue and return the foreign issues' metadata. This issue is fixed in 1.4.0.

Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can create relations linking their own issues to issues in any other workspace on the instance, leaking issue metadata through activity events. This issue is fixed in 1.4.0.

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a project in another workspace when the victim project UUID is known. This violates tenant isolation and permits unauthorized cross-workspace changes to project metadata and configuration. This issue is fixed in 1.4.0.

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/cycles/ through WorkspaceCyclesEndpoint and GET /api/workspaces/{slug}/modules/ through WorkspaceModulesEndpoint return records from every project in a workspace without checking whether the requester belongs to each project. Any authenticated workspace member, including a Guest with access to only one project, can enumerate names, descriptions, sprint dates, issue counts, progress snapshots, external integration IDs, linked URLs, and member lists for cycles and modules in private projects. The sibling WorkspaceLabelsEndpoint and WorkspaceStatesEndpoint apply the correct filter, making the cycle and module endpoints inconsistent outliers. This issue is fixed in 1.4.0.

Prior to version 1.4.0 of the Plane tool, the GET /api/v1/workspaces/{slug}/projects/{project_id}/members/ endpoint exposes the full project member roster, including email addresses, names, avatars, and roles. The ProjectMemberPermission access control only checks whether the caller is an active member of any project in the workspace, but does not bind the check to the specific project_id. As a result, any authenticated user belonging to one project, including a Guest, can read the roster of another private project in the same workspace.

Prior to version 1.4.0 of the Plane tool, the WorkspaceOwnerPermission does not require is_active=True when checking whether a user is a workspace owner. A deactivated user can therefore remain authorized as the workspace owner and retain owner-level access.

Prior to version 1.4.0 of the Plane tool, the GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ endpoint allows downloading project-bound files without enforcing access to the owning project. An authenticated user from the same workspace, not a member of the secret project, knowing the asset UUID, can receive a 302 redirect to a signed download URL. Affected types include ISSUE_ATTACHMENT, COMMENT_DESCRIPTION, PAGE_DESCRIPTION, and PROJECT_COVER.