CVE Vulnerability Catalog

Remnawave Backend prior to version 2.7.5 contains a glitch in the HWID device registration logic that allows an authenticated user to bypass the configured limit for HWID devices and register more devices than expected, enabling reselling subscriptions and consuming excessive traffic.

Kamailio before versions 6.0.5 and 5.8.7 contains an out-of-bounds read vulnerability in the auth module. A specially crafted SIP packet can cause a process crash (DoS) after successful user authentication without a database backend.

LightRAG prior to version 1.4.14 is vulnerable to a JWT algorithm confusion attack where an attacker can forge tokens by specifying 'alg': 'none' in the JWT header. The jwt.decode() call does not explicitly deny the 'none' algorithm, so a crafted token without a signature is accepted as valid, leading to unauthorized access. Fixed in version 1.4.14.

Vulnerability in LiquidJS before version 10.25.4, where the sort_natural filter bypasses the ownPropertyOnly security option. This allows template authors to extract values of prototype-inherited properties through a sorting side-channel attack.

LobeHub prior to 2.1.48 has a vulnerability in the webapi authentication layer that trusts a client-controlled X-lobe-chat-auth header that is only XOR-obfuscated, not signed or otherwise authenticated. Because the XOR key is hardcoded in the repository, an attacker can forge arbitrary auth payloads and bypass authentication on protected webapi routes including /webapi/chat/[provider], /webapi/models/[provider], /webapi/models/[provider]/pull, and /webapi/create-image/comfyui.

In InvenTree prior to versions 1.2.7 and 1.3.0, users with staff access permissions can install plugins via the API without requiring superuser account access. This is inconsistent with other plugin actions (such as uninstalling) which do require superuser access.

InvenTree from version 1.2.3 to 1.2.6 contains a remote code execution vulnerability. Although the template validator uses a sandbox, the renderer in part/helpers.py still uses a non-sandboxed environment, allowing a staff user to execute arbitrary code.

Saleor, an e-commerce platform, from version 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, has a vulnerability in the requestEmailChange() mutation that revealed the existence of user-provided email addresses in error messages. This is fixed in versions 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.

Saleor from 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118 has a business-logic and authorization flaw in the email change workflow. An email change token generated for one account can be replayed while authenticated as a different account, changing the second account's email to the token's new_email.

In LORIS (Longitudinal Online Research and Imaging System) versions 15.10 through 27.0.3 and 28.0.1, there is a cross-site scripting vulnerability in the survey_accounts module. When a user provides an invalid visit label, data is properly JSON encoded but the missing Content-Type header causes the browser to interpret the payload as HTML, enabling XSS if the user is tricked into clicking a malicious link.

In LORIS (Longitudinal Online Research and Imaging System) versions 21.0.0 through 27.0.3 and 28.0.1, the backend document endpoint did not properly verify access permissions. Although the frontend restricted file access, a user could theoretically download a file they should not have access to if they know or can brute force the filename.

LORIS versions 16.1.0 up to before 27.0.3 and 28.0.1 have a vulnerability in the media module. The backend does not check file access permissions, allowing unauthorized users to access files if they know the filename.

Zammad prior to version 7.0.1 contains an authorization failure in the REST endpoint POST /api/v1/ai_assistance/text_tools/:id. Context data (e.g., a group or organization) supplied for use in the AI prompt were not checked for accessibility by the current user, leading to unauthorized data being used in the prompt.

In Zammad, a web-based open source helpdesk system, prior to versions 7.0.1 and 6.5.4, the REST endpoint POST /api/v1/ai_assistance/text_tools/:id did not check if a user is privileged to use the text tool, allowing its use in all situations without proper authorization.

In Zammad, a web-based open source helpdesk system, prior to versions 7.0.1 and 6.5.4, the endpoint used for ticket creation was missing authorization when the parameter for adding links was used, allowing unauthorized ticket creation with links.

CSRF vulnerability in Zammad prior to 7.0.1 and 6.5.4. OAuth callback endpoints for Microsoft, Google, and Facebook do not validate a CSRF state parameter.

SSO mechanism vulnerability in Zammad prior to 7.0.1 and 6.5.4. The system did not verify the header originates from a trusted SSO proxy/gateway before applying actions.

Zammad, a web-based open source helpdesk/customer support system, prior to versions 7.0.1 and 6.5.4, had a vulnerability in the webhook model that lacked proper validation for loopback or link-local addresses. Only the URL scheme (HTTP/HTTPS) and hostname were checked, potentially leading to disclosure of confidential cloud/hosting metadata. The fix extends validation both when configuring webhooks and triggering webhook jobs.

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the HTML sanitizer for ticket articles was missing proper sanitization of data: ... URI schemes, resulting in storing such malicious content in the database. The Zammad GUI renders this content, but due to CSP rules no harm was done by clicking such a link. Fixed in 7.0.1 and 6.5.4.

Zammad prior to version 7.0.1 allows customers in shared organizations (who can see each other's tickets) to view fields not intended for customers, including internal fields (e.g., priority, custom attributes). This occurs when a customer opens a ticket from another user in the same organization. Customers cannot modify these fields.