CVE Vulnerability Catalog

An SQL Injection vulnerability (CWE-89) in Fortinet FortiMail 7.6.0 through 7.6.3, 7.4.0 through 7.4.5, and 7.2.0 through 7.2.8 allows an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests.

An SQL Injection vulnerability (CWE-89) in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, 7.4.0 through 7.4.7, 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, 7.4.1 through 7.4.7, and 7.2.1 through 7.2.11 may allow a low privileged user to execute arbitrary commands via crafted requests.

Podman from 4.4.0 until 5.8.8 and 6.1.3 treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL. This allows image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.

A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged with fstab options as strings; when the combined options are re-parsed, clearing options can override nosuid, nodev, and noexec protections the administrator intended to enforce.

In BusyBox's httpd web server, when configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.

A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity.

Leantime is an open source project management system. Prior to 3.10.0, the JSON-RPC API surfaces lack per-method authorization, allowing a low-privilege authenticated user to create an administrator account and manage plugins without proper permissions.

FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index.php that executes phpinfo(). A derived image that does not overwrite this placeholder serves the diagnostics page in production and can disclose environment variables used for secrets, PHP configuration directives, loaded extensions, software versions, and system paths. Images built using the documented pattern with their own /app/public/index.php are not affected, and already derived images must be rebuilt or supplied with an application index to remove the exposed placeholder. This issue is fixed in version 1.12.5.

FrankenPHP is a modern application server for PHP. Prior to 1.12.5, in worker mode, when the session extension is loaded as a shared module, PHP session state can be retained between requests, leading to cross-user session exposure and possible session hijacking.

Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <= iKuai8_3.7.23_Enterprise Build 202606021825 - Free Edition: <= iKuai 8_4.0.304-beta allows a remote attacker to execute arbitrary code.

Argo CD from 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. A user who can write to an Application's Git repository can commit a delete hook targeting a forbidden namespace, server, group, kind, or resource name, and deletion of the Application causes the application-controller to create that resource with its destination-cluster credentials. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.

A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true). An attacker can bypass the intended restriction by manipulating the signup workflow, resulting in unauthorized account creation.

Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to select post-authentication navigation, allowing a crafted state value to redirect a user to an attacker-chosen location. This issue is fixed in versions 15.116.0 and 16.29.0.

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to improper enforcement of behavioral workflow, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding, accepting the prohibited 'Transfer-Encoding: identity' form.

Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application.

Cronicle prior to 0.9.119 concatenates the attacker-controlled item.user.full_name value into HTML in the administrator Activity Log (htdocs/js/pages/admin/Activity.js) without applying encode_entities and inserts the result through this.div.html. The bundled pixl-server-user input filter can be bypassed by a tag containing a line break because its regular expression does not match newlines. An authenticated non-administrator can update their own name through /api/user/update, and when free_accounts is enabled an anonymous attacker can plant the name during self-registration. The stored name executes script in an administrator's session when the Activity Log is opened, enabling administrator takeover and subsequent command execution. This issue is fixed in version 0.9.119.

RClone Manager prior to 0.2.7 starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin *, and --rc-serve. A malicious web page opened by a user while the daemon is running can send cross-origin requests to the unauthenticated local API with the user's operating-system privileges. The requests can disclose configured storage credentials and potentially access, upload, modify, or exfiltrate locally stored files. The possible command-execution impact remains unconfirmed. This issue is fixed in version 0.2.7.

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods authorize callers with the read:admin role without confirming that the target UUID belongs to the requested and authenticated realm. A realm administrator can retrieve user data from another tenant or the master realm, breaking tenant isolation.

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method processes 0.xml from an uploaded ETS project ZIP with XML parsers that permit external entity resolution, allowing file reads accessible to the JVM process or server-side requests.