CVE Vulnerability Catalog

@hulumi/baseline versions before 1.3.2 fail to fully detect CloudTrail selector tampering events, reducing audit logging configuration change coverage. Attackers can modify CloudTrail event selectors without complete detection, potentially evading audit trail monitoring.

A vulnerability was detected in yaojingang GEOFlow up to 2.1.0. The function unlink in ImageLibraryController.php of the Image Library Cleanup component is vulnerable to path traversal via the file_path argument. The attack may be performed remotely, and the exploit is public. A fix is available in version 2.1.1.

A security flaw was discovered in valkey-io valkey 9.1.0. The function handleClientsBlockedOnKey in src/blocked.c of the Blocked-on-keys Subsystem is vulnerable to use after free. The attack may be performed remotely but is difficult to exploit due to high complexity. The exploit is public, and a patch is available.

A cross-site scripting vulnerability was found in Employee Leave Managing System 1.0 in the employee profile update function. Manipulation of the Name argument in editaction.php allows remote script execution. The exploit has been publicly disclosed.

In ash_phoenix (from 1.2.17 before 2.3.25), a vulnerability allows disclosure of sensitive information in error messages. The entire raw submitted param map is written into an exception message, potentially exposing secrets in logs and crash reports.

In ash_phoenix (from 0.6.0-rc.1 before 2.3.25), a vulnerability allows authorization bypass through user-controlled key. An attacker can filter across non-public relationships, potentially revealing private data.

A vulnerability in ash_admin allows an attacker who controls a record's string primary key to rewrite the target of AshAdmin's row-action links. Links are built via raw string interpolation without URL-encoding, enabling parameter injection and redirecting admins to unintended actions.

A vulnerability in ash_admin allows authorization bypass through user-controlled keys, turning a record-lookup URL into an equality oracle over sensitive attributes. The primary key decoding does not verify that returned fields are actual primary key fields, enabling brute-force of sensitive values.

A vulnerability in ash_admin involves the use of a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. The default nonce is a constant known from the repository and is not rotated, allowing its reuse to run unauthorized scripts.

A vulnerability in LatencyUtils up to 2.0.3 affects the function LatencyStats.recordDetectedPause in the PauseDetector component, which can lead to memory corruption. The attack requires local access and the exploit has been publicly disclosed.

Vulnerability in ash_graphql can deliver one subscription's resolved records to a different subscriber's topic. The process handling flaw causes data from one run to be incorrectly used in another, leading to unauthorized data exposure.

Vulnerability in ash_graphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see. The batching flaw skips authorization checks for some notifications.

Vulnerability in TOTOLINK N600R in the loginAuth function of cstecgi.cgi leads to insufficiently random values. Remote attack is possible but has high complexity and difficulty.

Vulnerability in ash_cloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of an encrypted field. The argument carrying plaintext is not marked as sensitive, leading to its exposure in error messages and logs.

Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. This can lead to writing files outside the target directory when recipients extract the archive.

A vulnerability in ash_sql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows. This occurs when an aggregate is computed over a distinct query, and the outer query is rebuilt without the schema prefix, leading to reads from the default schema instead of the tenant schema.

A vulnerability in ash_sql allows a caller to receive an aggregate value computed over rows a more restrictive filter should have excluded, disclosing counts, sums, or lists across an authorization or tenancy boundary. This occurs because two aggregate queries are considered identical when they differ only in filter, not sort.

A vulnerability in ash_sql allows a user to pad a string field with tab, newline, carriage-return, or form-feed characters and pass a trimmed uniqueness or equality check in the database that the same expression would fail in memory (or the reverse). This occurs because string_trim/1 in SQL removes only spaces, not all whitespace, causing behavioral differences between SQL and memory.

A vulnerability in ash_sql allows a user who supplies a search term to contains/2, string_starts_with/2, or string_ends_with/2 to inject live SQL LIKE wildcards, turning a literal substring search into an attacker-controlled pattern match. This occurs because escape helpers do not escape backslashes, allowing bypass of escaping and activation of wildcards.

A vulnerability was identified in Beetel 450TC3 01.00.00_01, affecting the User Management component. Manipulating the Username argument leads to cross site scripting. The attack can be carried out remotely, and the exploit is publicly available. The vendor did not respond.