CVE Vulnerability Catalog

AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and disclose filesystem paths.

In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly requesting media via the download endpoint using valid media identifiers, exposing private or restricted audio content.

Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh certificate can trigger a runtime panic by submitting a short base64-encoded ciphertext, causing log spam and request failures without crashing the process.

http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to { true }, so every nonce is accepted regardless of its value, age, or prior use. Applications relying on this default have no replay protection on Digest authentication: an attacker who can capture a valid 'Authorization: Digest' response (for example by observing network traffic or reading logs) can replay it indefinitely against the same protected resource.

A vulnerability in the Edimax BR-6428nC router version 1.16 affects an unknown function in the file /goform/formWizSurvey of the Wireless Wizard Handler component. Manipulation of the interface1/interface2 arguments leads to a stack-based buffer overflow. Remote exploitation is possible, and the exploit has been publicly disclosed.

http4k (Maven artifact org.http4k:http4k-core) before versions 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage that does not enforce RFC 6265 scoping rules for cookie domain, path, and Secure attributes. When a single BasicCookieStorage instance is used to talk to more than one origin or scheme, cookies stored for one origin can be sent to other origins, and cookies marked Secure can be sent over plain HTTP, potentially disclosing session cookies or other sensitive values to unauthorized hosts or network observers.

http4k (Maven package org.http4k:http4k-core) before versions 6.49.0.0, 5.42.0.0, and 4.51.0.0 uses substring (Contains) matching on the Host header by default in reverseProxy() and reverseProxyRouting() when dispatching to configured virtual hosts. If these functions are deployed as a public-facing inbound HTTP handler with two or more configured virtual hosts, a remote attacker can supply a Host header that merely contains a configured vhost name (for example Host: admin.evil.com for a vhost configured as "admin") and be routed to that vhost, bypassing routing-based authorization.

vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled() on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If an embedder exposes a constructable host function whose constructor returns a native rejected Promise, an untrusted script executed via VM.run can invoke it with `new` and ignore the result; the rejected host Promise crosses the bridge unhandled and, under Node's strict unhandled-rejection policy, is promoted to an uncaught exception that terminates the host process.

Contrast, a Kubernetes runtime for confidential containers, before version 1.12.1 has a vulnerability in the secure persistent volume feature. A malicious host can supply a crafted LUKS2 volume to a pod VM. LUKS2 volume metadata is not authenticated and, with cryptsetup versions prior to 2.8.1, a header specifying the null keyslot encryption algorithm (cipher_null-ecb) is accepted without error. Because the Contrast Initializer assumes a device is protected if `cryptsetup open` succeeds with the secret seed, the guest will open the attacker-supplied volume and write secret data in plaintext, or under a volume key known to the attacker, allowing the host to read confidential data that should have been encrypted.

Uncontrolled resource consumption (CWE-400) in Elasticsearch can lead to denial of service via excessive allocation (CAPEC-130).

Uncontrolled resource consumption (CWE-400) in Kibana can lead to denial of service via excessive allocation (CAPEC-130).

Uncontrolled resource consumption (CWE-400) in Elasticsearch can lead to denial of service via excessive allocation (CAPEC-130).

Uncontrolled resource consumption (CWE-400) in Elasticsearch can lead to denial of service via excessive allocation (CAPEC-130).

Uncontrolled resource consumption (CWE-400) in Elasticsearch can lead to denial of service via excessive allocation (CAPEC-130).

Uncontrolled resource consumption (CWE-400) in Elasticsearch can lead to denial of service via excessive allocation (CAPEC-130).

Uncontrolled resource consumption (CWE-400) in Elasticsearch can lead to denial of service via excessive allocation (CAPEC-130).

Uncontrolled resource consumption (CWE-400) in Elasticsearch can lead to denial of service via excessive allocation (CAPEC-130).

Missing authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via exploiting incorrectly configured access control security levels (CAPEC-180). An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that are shared into spaces they have no access to. Where a monitor is associated with a private location, the same operation also destroys the underlying Elastic Agent integration configuration without the authorization checks that Fleet would otherwise apply.

A vulnerability in Kibana allows authorization bypass through a user-controlled key (CWE-639). An authenticated user with the Timeline feature privilege in a Kibana space could enumerate, read, modify, and delete draft Timeline objects belonging to other users in the same space. Read access is sufficient for enumeration and disclosure; the Timeline write privilege is required for modification and deletion.

Credential disclosure vulnerability in Froxlor before version 2.3.12 in the DirProtections.listing API command that returns htpasswd password hashes. Authenticated API users can retrieve bcrypt password hashes for protected-directory users, enabling offline cracking attempts and exposure of reused credentials.