CVE Vulnerability Catalog

Pimcore before versions 11.5.17 (LTS) and 12.3.6 has inconsistent authorization between the report listing and report detail endpoints in CustomReports. A low-privileged backend user with the 'reports' permission can read an unshared report by name, accessing metadata, data source configuration, and sharing settings.

Vulnerability in Pimcore before versions 11.5.17 (LTS) and 12.3.7. The WebDAV endpoint `/asset/webdav{path}` allows MOVE operation without authentication, enabling an unauthorized attacker to delete, move, or overwrite assets.

Vulnerability in the @hapi/content library (versions before 6.0.2) for parsing HTTP Content-* headers. Different handling of duplicate parameters can lead to parameter smuggling and bypass of filename allowlists.

Pimcore prior to versions 11.5.17 (LTS) and 12.3.6 contains an SQL injection vulnerability in the columnConfigAction endpoint. An attacker with reports_config permission can execute arbitrary SELECT queries, use UNION statements, dangerous database functions, and error-based SQL injection to exfiltrate or manipulate data.

Vulnerability in the xdgmime library causes a heap-based buffer overflow when parsing MIME magic files on little-endian systems. An attacker can supply a malicious MIME magic file in the XDG_DATA_HOME location, leading to out-of-bounds write and potential application crash.

Vulnerability in IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 allows a remote attacker to obtain sensitive information due to exposure of session tokens in URLs.

IBM Langflow OSS versions 1.0.0 through 1.10.1 contain a vulnerability in the Python Interpreter component. An authenticated user can exploit improper input validation to execute arbitrary commands with elevated privileges.

IBM Storage Protect Client versions 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 through 8.2.1.0 contain a heap-based buffer overflow vulnerability due to improper bounds checking. A remote attacker can overflow a buffer and execute arbitrary code on the system or cause the server to crash.

IBM Langflow OSS versions 1.0.0 through 1.10.1 contain an unauthenticated remote code execution vulnerability in the public flow build endpoint (/api/v1/build_public_tmp/{flow_id}/flow). The vulnerability stems from an incomplete denylist in the validate_public_flow_no_code_execution() function that fails to block several code-execution agent components including OpenDsStarAgent, CodeActAgentSmolagents, and CSVAgent.

Vulnerability in RISC-V PicoRV32 (commit 87c89a) due to a mismatch between PCPI INSN and memory address, leading to unexpected behavior.

IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

Agentic-Flow before version 2.0.14 contains an OS command injection vulnerability. Attackers can manipulate MCP tool parameters such as agent, task, name, language, and agentdb, which are directly interpolated into shell command strings executed by execSync(). This allows remote arbitrary code execution with the privileges of the MCP server user.

A vulnerability in the SCRAM library allows an attacker performing a TLS man-in-the-middle attack to silently downgrade a connection from SCRAM-SHA-256-PLUS with channel binding to standard SCRAM-SHA-256 without channel binding. The issue occurs when TlsServerEndpoint processes an X.509 certificate using a modern signature algorithm such as Ed25519, and getChannelBindingData() can return an empty byte array after NoSuchAlgorithmException.

JSONata, a JSON query and transformation language, prior to versions 2.2.0 and 1.8.9, is vulnerable to DoS via malicious input to the $toMillis function. Non-matching inputs cause superlinear backtracking in the ISO-8601 validation regex, leading to denial of service. Fixed in versions 2.2.0 and 1.8.9.

Vulnerability in AsyncSSH before version 2.23.0 allows an attacker to exploit the %u token expansion in AuthorizedKeysFile to read key files outside the intended directory using path traversal segments (/, \, ..). The attacker can authenticate using a chosen key file.

Pimcore before versions 11.5.17 (LTS) and 12.3.7 calls PHP unserialize() on data from database columns and files without the allowed_classes restriction in multiple locations, including lib/Tool/Authentication.php. This enables object injection and remote code execution if an attacker can control the serialized data source.

IBM Db2 versions 11.5.0-11.5.9 and 12.1.0-12.1.4 are vulnerable to remote code execution when the JDBC URL is under user control.

The Datadog .NET Tracer library before version 3.43.0 does not enforce limits on the number or size of W3C baggage items when parsing incoming HTTP headers, allowing a remote unauthenticated attacker to send a malicious baggage header with many key-value pairs or a very large value, causing unbounded CPU and memory consumption in services with baggage propagation enabled.

A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) within the voicemail notification template functionality. The submit_modify_voicemail_template endpoint fails to properly sanitize HTML content supplied by authenticated users, allowing malicious JavaScript to be stored server-side and rendered to other users.

An authenticated local file inclusion vulnerability in Sangoma Switchvox SMB Edition 8.3 allows reading arbitrary files via the play_file function. The sound_path parameter lacks proper validation, enabling absolute path traversal.