CVE Vulnerability Catalog

The Translate extension for MediaWiki has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. This issue affects versions before 1.46.1, 1.45.5, and 1.43.10.

Vulnerability of sensitive information exposure to unauthorized actor in Mediawiki WikiLambda Extension. Affects version 1.47.0-alpha and has been remediated on the master branch.

Cross-Site Scripting (XSS) vulnerability in Mediawiki TemplateSandbox Extension due to improper input neutralization during web page generation. Affects versions before 1.46.1, 1.45.5, and 1.43.10.

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behavior and may not trigger. When the check is optimized away, a malicious SOAP server can cause allocation of a buffer too small, leading to heap buffer overflow.

Reflected XSS vulnerability in Mediawiki Cargo extension due to improper input neutralization during web page generation. Affects versions through 3.9.4.

Reflected XSS vulnerability in Mediawiki Cargo extension due to improper input neutralization during web page generation. Affects versions through 3.9.4.

Reflected XSS vulnerability in Mediawiki Cargo extension due to improper input neutralization during web page generation. Affects versions through 3.9.4.

Stored XSS vulnerability in Mediawiki Cargo extension due to improper input neutralization during web page generation. Affects versions through 3.9.4.

When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory.

OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal hosts, allowing the server to send requests to private networks and cloud metadata endpoints while returning HTTP status codes that enable blind SSRF probing.

A vulnerability was determined in krayin laravel-crm up to 2.2.5. This affects an unknown part of the file packages/Webkul/Admin/src/Http/Controllers/Settings/UserController.php of the component User Management. Executing a manipulation of the argument role_id can lead to improper privilege management. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.2.6 is able to mitigate this issue.

In Zammad prior to 7.1.2, a user with Knowledge Base editing rights can embed a video widget with a specially crafted value that is not escaped for its attribute context. When another user with session-switching permission opens the answer, their browser sends a request to Zammad's session-switching endpoint using their own credentials, switching them to an account chosen by the answer's author.

In Zammad prior to 7.1.2, the two-factor login step allowed an attacker to try unlimited password guesses without triggering lockout or rate limiting. The response also revealed whether a guess was correct before two-factor authentication was checked.

In Zammad prior to 7.1.2, any authenticated user can call the REST endpoint for a tag list and receive tag names for any ticket regardless of access rights. Since ticket IDs are sequential integers, bulk enumeration is straightforward.

In Zammad prior to 7.1.2, unsanitized option labels are rendered in AI Agent configuration dialogs in the admin UI. The option label is output as raw HTML without escaping, allowing an attacker who controls the label to inject arbitrary HTML and JavaScript.

In Zammad prior to 7.1.2, when a Microsoft Graph request fails, the error is logged including the authentication token. Masking is incomplete: for the JWT format only the first part is hidden, while the remaining parts stay readable in plain text.

In Zammad 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration credentials in cleartext through the integration administration API. Some responses do not consistently mask sensitive fields, so configured secrets can be returned in plain text.

In Zammad prior to 7.1.2, the HTML sanitizer blocking remote images in ticket articles and email views can be bypassed using a shortened URL format that omits the double slash after the scheme. Modern browsers treat both forms as equivalent, so a crafted email or ticket can silently load an image from an external server.

In Zammad prior to 7.1.2, when creating or updating an email signature, inline images referenced in the signature body are processed. If the body contains an img tag pointing to an existing attachment, the system copies it into a new signature-owned record without checking the user's permission to access the original attachment.

In Zammad prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets can bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected API endpoint and sends the request with the agent's session cookie.