CVE Vulnerability Catalog

There is a format string vulnerability in the distributed file system. Attackers who bypass SELinux permissions can exploit this vulnerability to crash the program.

Vulnerability related to incomplete verification of apps' permissions to access a certain API in the wireless projection module. Successful exploitation of this vulnerability may affect some wireless projection features.

Vulnerability related to incomplete input parameter verification in the communication framework module. Successful exploitation of this vulnerability may affect system availability.

An Out-of-bounds Read vulnerability exists in the GitHub repository gpac/gpac prior to version 2.2.2.

A Cross-site Scripting (XSS) vulnerability is reflected in the GitHub repository fossbilling/fossbilling prior to version 0.5.4.

In the GitHub repository it-novum/openitcockpit prior to version 4.6.6, there is a vulnerability related to sensitive cookies in HTTPS sessions that lack the 'Secure' attribute.

Statamic is a flat-first content management system powered by Laravel and Git. In versions prior to 4.10.0, the SVG tag does not sanitize malicious SVG, allowing attackers to perform cross-site scripting attacks using SVG, even when using the `sanitize` function. Version 4.10.0 contains a patch for this issue.

Fides is an open-source privacy engineering platform with a path traversal vulnerability in versions below 2.15.1. This allows remote attackers to access arbitrary files on the Fides webserver container's filesystem.

Uptime Kuma, a monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. This allows authenticated users to delete files from the server, potentially leading to data loss and system unavailability.

Uptime Kuma, a monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lead to remote code execution. Although the plugin installation feature is currently disabled in the web interface, the corresponding API endpoints are still available after login.

Kanboard is project management software that focuses on the Kanban methodology. In versions prior to 1.2.31 authenticated user is able to perform a SQL Injection, leading to a privilege escalation or loss of confidentiality.

Kiwi TCMS, a test management system, had an issue with incorrect Nginx configuration that allowed potentially dangerous scripts to be executed from attachments. Versions prior to 12.5 improperly handled the `Content-Type: text/plain` header, posing a risk to users.

GLPI, an IT asset management software, is vulnerable to SQL injection in the Computer Virtual Machine form and inventory request. This issue affects versions from 0.80 up to but not including 10.0.8, with a patch available in version 10.0.8.

1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker could craft malicious payloads to achieve command injection when entering the container terminal.

1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious payload to achieve command injection when adding container repositories.

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a file allows an unauthenticated user to access dashboards data.

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a file accessible by an authenticated user allows a threat actor to interact, modify, or see Dashboard data.

Pandoc, a Haskell library for converting markup formats, has an arbitrary file write vulnerability that can be triggered by a specially crafted image element in the input. This affects versions from 1.13 to 3.1.4 when generating files using the `--extract-media` option or outputting to PDF format.

Loxone Miniserver Go Gen.2 versions up to 14.0.3.28 allow an authenticated operating system user to escalate privileges via the Sudo configuration. This enables elevated execution of binaries without a password requirement.

The root password of the Loxone Miniserver Go Gen.2 before version 14.2 is calculated using hard-coded secrets and the MAC address. This allows a local user to calculate the root password and escalate privileges.