CVE Vulnerability Catalog

Plane, an open-source project management tool, has a vulnerability in the IssueBulkUpdateDateEndpoint that allows a project member to modify start_date and target_date of any issue across the entire instance, regardless of workspace or project membership. This affects versions prior to 1.3.0.

JWCrypto before 1.5.7 does not validate decompressed output size in JWE tokens with ZIP compression. An attacker can send a small token (under 250KB) that decompresses to about 100MB, causing server memory exhaustion.

WWBN AVideo, an open-source video platform, has a Server-Side Request Forgery (SSRF) vulnerability in the Live restream log callback flow. An authenticated streamer can store an arbitrary callback URL that is later fetched server-side. This affects versions 26.0 and prior.

AVideo is an open source video platform where the EPG feature parses XML from user-controlled URLs and renders programme titles directly into HTML without sanitization. A user with upload permission can set a malicious XML file with JavaScript in <title> elements. This affects versions 26.0 and prior.

WWBN AVideo versions 26.0 and prior have a vulnerability in the PayPal IPN v1 handler that lacks transaction deduplication. An attacker can replay a single IPN notification to repeatedly inflate wallet balance and renew subscriptions.

Vite, a frontend tooling framework for JavaScript, versions 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, has a vulnerability in handling .map requests for optimized dependencies. The dev server resolves file paths and calls readFile without restricting ../ segments in the URL, allowing bypass of the server.fs.strict allow list and retrieval of .map files outside the project root if they can be parsed as valid source map JSON.

Semtech LR11xx LoRa transceivers with early firmware versions have an information disclosure vulnerability in firmware validation. After a firmware validity check command via SPI, the last decrypted block remains in memory, allowing an attacker with SPI access to read the decrypted firmware.

Semtech LoRa LR11xxx transceivers with early firmware versions have improper access control allowing stack memory writes via the SPI interface. An attacker with physical access can hijack program flow and execute arbitrary code, but changes are lost on reboot.

The ReportIncident extension in Wikimedia Foundation MediaWiki has an allocation of resources without limits vulnerability, allowing HTTP DoS attacks. The fix is only available on the master branch.

RustFS is a distributed object storage system where prior to alpha.90, there is a missing authorization check in the multipart copy path (UploadPartCopy). A low-privileged user who cannot read objects from a victim bucket can copy victim objects into an attacker-controlled multipart upload and complete the upload.

Scoold, a Q&A and knowledge sharing platform for teams, has an authorization flaw that allows any logged-in, low-privilege user to overwrite another user's existing question by supplying its public ID as the postId parameter. This affects versions prior to 1.66.2.

OrangeHRM Open Source versions 5.0 through 5.8 omit authorization on job specification and vacancy attachment download handlers. Authenticated low-privilege users can read attachments via direct reference to attachment identifiers.

OrangeHRM Open Source from 5.0 to 5.8 allowed authenticated users to bypass disabled-module access controls via URL-encoded request paths and access functionality of modules disabled by an administrator. Fixed in 5.8.1.

OrangeHRM Open Source versions 5.0 to 5.8 fail to restrict email template file resolution to the intended plugins directory, allowing an authenticated attacker who can influence the template path to read arbitrary local files. This is fixed in version 5.8.1.

Improper neutralization of alternate XSS syntax vulnerability in The Wikimedia Foundation Mediawiki - Wikilove Extension allows Cross-Site Scripting (XSS). The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.

OpenViking versions prior to 0.3.3 have a missing authorization vulnerability in task polling endpoints. Unauthenticated attackers can enumerate or retrieve background task metadata created by other users, including task type, status, resource identifiers, archive URIs, result payloads, and error information.

In Modem, there is a possible system crash due to a logic error, which could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker. No additional execution privileges or user interaction needed.

SQL Injection vulnerability in itsourcecode Construction Management System 1.0. An unknown function in /borrowedtool.php allows manipulation of the code argument, leading to SQL injection. Remote attack possible. Exploit published.

IBM Concert versions 1.0.0 through 2.2.0 creates temporary files with predictable names. A local user can exploit a symlink attack to overwrite arbitrary files.

In code-projects Online Hotel Booking 1.0, the file /booknow.php is vulnerable to XSS via the roomname parameter. The attack can be launched remotely and the exploit is publicly available.