CVE Vulnerability Catalog

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to improper enforcement of behavioral workflow, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding, accepting the prohibited 'Transfer-Encoding: identity' form.

Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application.

Cronicle prior to 0.9.119 concatenates the attacker-controlled item.user.full_name value into HTML in the administrator Activity Log (htdocs/js/pages/admin/Activity.js) without applying encode_entities and inserts the result through this.div.html. The bundled pixl-server-user input filter can be bypassed by a tag containing a line break because its regular expression does not match newlines. An authenticated non-administrator can update their own name through /api/user/update, and when free_accounts is enabled an anonymous attacker can plant the name during self-registration. The stored name executes script in an administrator's session when the Activity Log is opened, enabling administrator takeover and subsequent command execution. This issue is fixed in version 0.9.119.

RClone Manager prior to 0.2.7 starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin *, and --rc-serve. A malicious web page opened by a user while the daemon is running can send cross-origin requests to the unauthenticated local API with the user's operating-system privileges. The requests can disclose configured storage credentials and potentially access, upload, modify, or exfiltrate locally stored files. The possible command-execution impact remains unconfirmed. This issue is fixed in version 0.2.7.

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods authorize callers with the read:admin role without confirming that the target UUID belongs to the requested and authenticated realm. A realm administrator can retrieve user data from another tenant or the master realm, breaking tenant isolation.

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method processes 0.xml from an uploaded ETS project ZIP with XML parsers that permit external entity resolution, allowing file reads accessible to the JVM process or server-side requests.

OpenCATS prior to 0.10.0, in the Import module (modules/import/ImportUI.php), can preserve an uploaded file's original name for one import data type and place the file in the web-accessible temporary directory. An authenticated user with Import privileges can select the affected import path and upload a PHP file that remains under an attacker-controlled executable filename, and an import error can leave the file on disk. If the temporary directory is served with PHP execution enabled, requesting the staged file can execute arbitrary PHP code with the web server process privileges. This issue is fixed in version 0.10.0.

Citrix UniconOS contains an improper link resolution before file access ('link following') vulnerability. This issue affects versions before 2607 CR and before 2603 LTSR CU2.

A vulnerability in the Bluetooth Classic Hands-Free Profile Audio Gateway (HFP AG) implementation in Zephyr RTOS causes corruption of the kernel timeout list. By sending AT+CIND? and quickly reconnecting, a remote attacker can trigger a system-wide fault or hang.

In the AVDTP signalling layer of the Zephyr RTOS Bluetooth stack, the L2CAP disconnect handler (bt_avdtp_l2cap_disconnected) failed to cancel the armed delayed timeout_work, leaving it linked in the kernel's global timeout list. When the bt_avdtp session struct is zeroed by memset() on reconnect, the kernel treats the still-linked timeout node as free, corrupting the global timeout list and causing a system-wide crash or hang. The vulnerability requires CONFIG_BT_A2DP (experimental) to be enabled and an encrypted BR/EDR link.

ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id} endpoints. Unauthenticated attackers can read unpublished draft and soft-deleted articles by requesting sequential article ids or supplying isDraft=true or isDel=true query parameters.

fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint. Authenticated members can read other members' refund records by registering freely and enumerating sequential refundId values, obtaining buyers' names, national ID numbers, addresses, WeChat openIds, and order details.

fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/order/detail endpoint. Attackers can enumerate sequential orderId values without an Access-Token to expose buyer personal data.

waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController. Authenticated members can modify or delete other members' cart items by enumerating sequential cart ids via PUT /cart, POST /cart/changeNum, and DELETE /cart/{cartId} to change quantities, selection state, or remove items.

waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController. Authenticated members can modify or delete other members' shipping addresses by enumerating auto-increment address ids and sending POST /address or DELETE /address/{addressId} requests.

Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by supplying their order identifiers. Attackers can enumerate sequential order ids or serial numbers via detail, cancel, confirm, delete and refund endpoints to read recipient addresses and phone numbers or disrupt orders.

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs.

Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS configurations by calling /sys/mail/config/list and /sys/sms/config/list without the required authority checks.

PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight. GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight update goods and SKUs by id without store-scoped checks, letting sellers bind their own templates to competitors' products and alter shipping charges.

PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/{goodsId} to replace product details and SKUs and reassign products to their own store.