CVE Vulnerability Catalog

In Lychee before 7.7.0, ImageMagick PDF support with Ghostscript does not apply an effective pre-render limit to PDF page dimensions in ImagickHandler::loadPdf(). An authenticated user can upload a small PDF with an oversized /MediaBox, causing significant CPU consumption and clogging the image-processing queue.

In Lychee before 7.7.0, the hidden Omnipay Dummy test provider can be used by a buyer (including a guest) by submitting it directly, as CreateSessionRequest does not enforce OmnipayProviderType::isAllowed(). This allows completing the test gateway flow without a real payment and releasing the purchasable item if auto-fulfillment is enabled.

In Lychee before 7.6.4, SecurePathController serving GET /image/{path} concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under a specific non-default configuration, any authenticated user can read files outside the intended directory, including application configuration and other users' private images.

In Lychee before 7.6.3, the GET /api/v2/Zip endpoint authorizes album and photo archives through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first enforcing AlbumPolicy::canAccess(). For a public, password-protected album with grants_download enabled, an unauthenticated attacker who knows the album identifier can download a ZIP archive without supplying the password.

In Lychee before 7.6.1, the POST /api/v2/Album::unlock endpoint has no throttle, attempt counter, backoff, CAPTCHA, or lockout. A remote unauthenticated attacker who knows the album identifier can automate password guesses against a password-protected album and gain access to its private photo collection.

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photos_star_visibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved() invokes SetPhotosHighlightedRequest::processValidatedValues() before authorization, and PhotoPolicy::canHighlight() returns true for anonymous callers without a canSee check. An unauthenticated attacker who can guess photo identifiers can distinguish existing private photos through differing success and not-found responses and can change their is_highlighted state, including for photos in private or password-protected albums. The issue is limited to installations using the non-default anonymous star-visibility setting. This issue is fixed in version 7.6.1.

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.php for a separate fopen connection. An authenticated attacker who controls DNS responses can cause validation to observe a public address and the subsequent fetch to resolve the same hostname to a private or otherwise forbidden address. This DNS rebinding time-of-check to time-of-use mismatch bypasses the intended server-side request forgery protections and can reach services available from the Lychee server, subject to deployment and TLS behavior. This issue is fixed in version 7.6.0.

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a javascript URI in an album or photo Markdown description because config/markdown.php enables allow_unsafe_links. PreformattedPhotoData.php and PreFormattedAlbumData.php convert the description to HTML, and gallery components render that HTML with v-html, so a visitor clicking the rendered link executes attacker-controlled JavaScript in the Lychee origin.

Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in auto-update should upgrade to Amazon Neptune engine version 1.5.0.0.(Backports to 1.4.8.1 and 1.4.7.1)

The XStore plugin for WordPress contains a Reflected XSS vulnerability caused by improper neutralization of input during web page generation. The issue affects versions prior to 9.7.9.

In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, and does not reject a conflicting non-empty provider ID. If an identity provider reassigns an email address, which authd uses as the username, to a new account, the new account inherits the previous user's local UID and home directory on its next login.

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /_og/d/*.png route accepts unsigned requests while resolvePathCacheKey() produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server responses. An unauthenticated attacker can provide attacker-controlled image data through the title parameter together with a derived cacheKey and populate the cache slot used for a legitimate Open Graph image, causing spoofed image content to be served to users.

OpenNext Cloudflare, a Next.js adapter for Cloudflare, in versions from 0.3.0 until 1.20.2 mishandles encoded pathnames when cache interception is enabled and access control relies on middleware. An unauthenticated attacker can retrieve cached protected content using a percent-encoded pathname that does not match authorization middleware but decodes to the cache key of a protected route.

kin-openapi, a Go project for handling OpenAPI files, prior to 0.149.0 lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema during runtime request and response validation. This causes unbounded recursion and a fatal stack overflow that terminates the entire process and cannot be caught with recover.

kin-openapi, a Go project for handling OpenAPI files, in versions from 0.136.0 until 0.149.0 lacks a nil-items guard for legal OpenAPI 3.1 array schemas in three openapi3filter decoder paths. An unauthenticated remote client can trigger a deterministic nil-pointer panic via an array query parameter, a deepObject query parameter, or an application/x-www-form-urlencoded request body.

Sonatype Nexus Repository 3 allows a user holding the role create or role update permission to grant roles and privileges that the account does not hold. This can lead to privilege escalation up to full administrative access.

Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the permissions of the viewing user.

Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code execution.

Nexus Repository 3 lacks an authorization check in the NuGet Components API upload path, allowing an account with only repository read and browse privileges to upload NuGet symbol packages (.snupkg). Exploitation requires a hosted NuGet repository with Symbol Server enabled, and with anonymous access enabled this precondition is met by default.

kin-openapi, a Go project for handling OpenAPI files, in versions from 0.136.0 until 0.143.0 accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding requests and responses. A remote unauthenticated client can deterministically trigger a nil-pointer panic during ValidateRequest or ValidateResponse.