CVE Vulnerability Catalog

Kiota before versions 1.29.1 and 1.32.5 resolved OpenAPI $ref values by fetching remote URLs and reading local file paths, allowing SSRF, remote file inclusion, and local file inclusion during client generation.

In SimpleChat prior to version 0.241.206, several plugin validation routes lacked enforcement of authentication and authorization at runtime. Routes such as POST /api/admin/plugins/test-instantiation, GET /api/admin/plugins/health-check/<plugin_name>, POST /api/admin/plugins/repair/<plugin_name>, and POST /api/plugins/validate were documented as requiring security but did not check if the user was logged in or had proper permissions. This allowed unauthenticated or unauthorized clients to invoke plugin validation, health check, and repair operations.

In Prompty prior to version 2.0.0-beta.2, the loaders expanded ${file:...} references in .prompty frontmatter without validating that resolved paths stayed within the allowed directory, allowing an attacker-controlled prompt file to read local files via absolute paths, .. traversal, or symlink escapes.

A vulnerability in the Prompty library allows arbitrary JavaScript execution when loading .prompty files. The TypeScript loader uses gray-matter without overriding default frontmatter engines, enabling an attacker to inject malicious code via a file with ---js frontmatter.

A vulnerability in LogicalDOC Enterprise up to version 9.1.1 allows an authenticated attacker to perform blind SQL injection in the ComparisonServlet component. Crafted input can be used to manipulate SQL queries.

Kiota before versions 1.29.1 and 1.32.5 honored a poisoned workspace.json configuration without validating output paths, allowing generated files to be written outside the workspace root on a developer or CI host.

Kiota before versions 1.29.1 and 1.32.0 in the Python generator did not sanitize enum value descriptions, allowing Python code injection into generated comments that could be executed when modules are imported.

Kiota before versions 1.29.1 and 1.32.0 in the Ruby generator did not escape the # character in string literals, allowing arbitrary Ruby code injection into generated model classes.

Kiota before versions 1.29.1 and 1.32.3 has a code-generation injection vulnerability in the C# XML documentation-comment sink, where text from an OpenAPI description is written without stripping newline characters, allowing injection of additional code into generated C# clients.

Kiota, an OpenAPI based HTTP client code generator, prior to versions 1.29.1 and 1.32.4 contains a PHP code injection vulnerability. The PHP generator fails to escape the $ character in double-quoted strings, allowing attacker-controlled interpolation constructs to inject arbitrary PHP code into generated model and request-builder classes.

A race condition in the account lockout mechanism of Delphix Continuous Data allowed concurrent authentication requests to be processed before the failed-login counter and lockout status were updated, bypassing the lockout threshold.

A flaw was found in PipeWire, a multimedia server, allowing an attacker to escape sandboxed applications like Flatpak. The vulnerability exploits PipeWire's PulseAudio compatibility layer to load a malicious library from within a sandbox with minimal permissions.

Stoatchat before version 0.13.5 contains an unauthenticated server-side request forgery (SSRF) vulnerability in the /proxy and /embed endpoints that accept arbitrary URLs without DNS resolution filtering or private IP range validation. Attackers can enumerate internal services, fingerprint applications, and reach instance metadata endpoints by supplying malicious URLs or leveraging redirect chains.

AVideo through version 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint. The notifyCode and callback parameters are concatenated into a shell command without escaping, allowing attackers to execute arbitrary OS commands as the web-server user.

In AVideo up to version 29.0, the listFFmpegProcesses() function in plugin/API/standAlone/functions.php interpolates unsanitized keyword parameters inside single quotes without escaping. Attackers who can craft a valid encrypted codeToExec payload can break out of the single-quoted grep context and execute arbitrary OS commands as the web-server user.

A vulnerability in stoatchat (delta/Revolt) versions from 20241213-1 before 20250210-1 allows users with ViewChannel (read) permission on a channel to fetch that channel's webhooks, including their tokens, due to checking ViewChannel instead of ManageWebhooks in the webhook fetch endpoint.

In stoatchat (delta) versions before 20250210-1 (0.8.2), a logic error exists in the query messages route. When fetching messages 'nearby' another message, the database query can be given a message limit of zero, which the database interprets as 'no limit'. A remote unauthenticated attacker can craft nearby message fetch requests to download an entire channel's message history in a single expensive request, and can send many such requests in parallel, resulting in denial of service through resource exhaustion.

HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid credentials can exploit this flaw by intercepting and altering the server's authentication responses, allowing them to gain unauthorized access to the application without verification.

HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's authentication status when accessing specific API endpoints, allowing an unauthenticated attacker to interact with the APIs and perform unauthorized actions without valid credentials.

The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields' parameter in versions up to and including 2.7.1 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.