CVE Vulnerability Catalog

IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browsers when served from the /public route.

OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction, so its install.sh runs as root on the next update.

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet.

The Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxying of requests to private IP addresses).

Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with read access to this log, or to a backup or support bundle that includes it, can obtain the logged credential.

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints.

UTMStack before 11.2.16 contains a JPQL injection vulnerability. An authenticated attacker can read arbitrary entity data by injecting malicious JPQL through the value parameter in the GET /api/utm-network-scans/searchPropertyValues endpoint, as the query is built with String.format() without parameter binding.

UTMStack before 11.2.16 contains an account enumeration vulnerability. An unauthenticated attacker can determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint.

Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view union and subtraction operations fail to release new key-identity and value references for each operand element, leaking two strong references per element. Applications performing these operations over attacker-influenced sequences can experience unbounded memory growth and denial of service.

The postgresql-operator charm runs a Prometheus postgres_exporter that writes the monitoring user's password in cleartext to its logs on database connection errors. Anyone able to read those logs can recover the password, which grants read-only pg_monitor access to PostgreSQL.

UTMStack before 11.2.16 contains a server-side request forgery (SSRF) vulnerability in IdentityProviderService.validateMetadataUrl(). An authenticated attacker can make the server send requests to arbitrary internal or cloud metadata hosts by supplying a malicious metadata URL to the identity-providers endpoint.

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option enabled, an attacker who obtains or infers the machine's system ID can query the preseed/metadata server to leak the secret.

OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose, @opentelemetry/instrumentation-mysql, and @opentelemetry/instrumentation-mysql2, 0.46.0 of @opentelemetry/instrumentation-oracledb, 0.73.0 of @opentelemetry/instrumentation-pg, and 0.40.0 of @opentelemetry/instrumentation-tedious, the packages add the database connection username to every instrumented database operation as the db.user span attribute. The attribute is emitted by default and is not controlled by enhancedDatabaseReporting or another opt-in setting.

Angular SSR is a server-side rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containing a backslash parent-traversal segment on Windows. An unauthenticated requester can retrieve a sibling prerendered HTML page when that page contains the Angular SSG marker.

oRPC is a tool that helps build APIs that are end-to-end type-safe. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin collect object properties in plain objects and resolve shape keys through the prototype chain. A remote client can supply __proto__ to replace the prototype of the returned request object, allowing attacker-controlled inherited values to reach application lookups.

oRPC is a tool that helps build APIs that are end-to-end type-safe. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain. A remote client can supply __proto__ to replace the prototype of the single coerced request object, or supply Object.prototype member names such as constructor and toString so inherited values are treated as sub-schemas.

The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip. This allows unauthenticated users to execute arbitrary shortcodes registered on the site, and on sites upgraded from older versions the protection is disabled outright.

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations. This is achieved via a crafted discovery document address supplied when registering a tool server or remote agent configured for delegated authentication.

Nx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx migration planning reads the nx-migrations.migrations value from a target package manifest without validating that it is a contained relative path. A hostile dependency can supply .. segments or an absolute path, causing the migration archive to write attacker-controlled bytes outside the temporary directory or truncate an existing writable file.