CVE Vulnerability Catalog

Prior to 7.0.2, any authenticated agent in Zammad can view titles, statuses, labels, and URLs of GitHub/GitLab issues attached to any ticket by querying ticket IDs. This breaks ticket isolation boundaries between agents.

A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. The affected element is an unknown function of the file SecurityConfig.java of the component api-docs Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the terminal to obtain text typed into a prompt displayed by kitty. The handle_remote_askpass() function opens the POSIX shared memory object named in the escape code and writes the user's answer back without verifying ownership or permissions. An attacker can create such an object, cause the victim's kitty to render a prompt of their choosing, and read the typed secret afterwards.

Use After Free vulnerability in the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the terminal to read from and write to freed heap memory. The bug occurs in drag_remote_file_data() in kitty/dnd.c, where a pointer to an array is used after it has been freed by helper functions.

Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full content of private drafts and scheduled posts belonging to any other user, including administrators, by exploiting the content-get-list AJAX endpoint.

Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request, enabling page conversion or ownership transfer.

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly, enabling file uploads without required permissions.

Missing Authorization in the drop handling path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to obtain the contents of files dragged over the window even when the user never completes the drop, and to continue reading files after the drag leaves the window.

In RabbitMQ Management with the OAuth management UI enabled, an AMQP authorization-error reason containing an attacker-controlled queue name is rendered as HTML. A queue name containing a base element can retarget the automatic relative refresh, and via CORS an attacker endpoint can receive the victim's Authorization header.

RabbitMQ versions from 3.13.0 to 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5 contain a vulnerability where OAuth credential refresh retains revoked runtime tags. When an existing AMQP connection refreshes from an OAuth token granting the impersonator tag to a valid same-username token that no longer grants it, the connection's runtime tags are unchanged. Thus, the connection (including newly opened channels) can continue publishing with a foreign AMQP userid after the privilege should have been revoked.

Vulnerability in RabbitMQ before 4.3.5. An authenticated user who can bind a queue to a topic exchange and publish to it can use consecutive # segments in a binding key to make both topic matchers revisit the same states without memoization. This causes duplicate destinations to be materialized before deduplication, leading to combinatorial CPU and memory pressure, disrupting routing for all tenants.

The Shovel parameter parser in RabbitMQ converts attacker-controlled runtime parameter values into non-garbage-collected Erlang atoms before bounding them or checking a fixed allowlist. An attacker can exhaust the node-wide atom table and deny service, and malicious parameters are stored durably and reparsed when workers start.

The optional rabbitmq_jms_topic_exchange plugin in RabbitMQ accepts a client-controlled rjms_erlang_selector binding expression whose LIKE evaluator expands wildcards into overlapping PCRE fragments executed without match or recursion limits. An authenticated tenant can consume broker scheduler CPU and deny service with pathological selectors.

Vulnerability in RabbitMQ from 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, where JWKS fetch ignores HTTP response status code. The JWKS key fetching mechanism in uaajwt.erl does not validate the HTTP response status code when downloading signing keys from the OAuth2 provider's JWKS endpoint. Non-200 responses (including 4xx and 5xx errors) are processed identically to successful responses. When the JWKS endpoint returns an error response with a valid JSON body lacking a keys field, all previously cached signing keys are destroyed, causing persistent authentication denial of service.

Vulnerability in RabbitMQ from 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, allowing low-privilege node denial of service via stream management super-stream binding keys allocation. The handler accepts PUT /api/stream/super-streams/{vhost}/{name} from an authenticated management user with access to the target vhost. When the request body contains the binding-keys field, the handler parses the attacker-controlled comma-separated string and builds the full stream-name list before checking whether the user has permission to configure the resulting streams. A low-privileged management user with vhost access can force large transient allocations. In a 768 MB memory-limited container, one HTTP PUT with about 4.5 MB of JSON body killed the container.

Shovel in RabbitMQ does not format state logged by the crash reporter, potentially leaving unencrypted credentials in a crash dump file. When Shovel worker processes crash, the OTP SASL error handler writes the full process state, including plaintext AMQP passwords and URIs, to the error log.

In RabbitMQ, the OAuth2 isinteger(Exp) guard skips token-expiry checks for float exp values. When the IdP emits exp as a JSON float, both the login-time expiry check and the mid-connection disconnect timer are silently skipped, so an already-expired token is accepted and connections never time out.

In RabbitMQ, AMQP 1.0 management exchange.declare skips the alternate-exchange permission check. A user with only configure permission on exchange X can route X's unroutable messages into an alternate exchange they have no write permission on.

RabbitMQ versions from 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3 contain a Stored XSS vulnerability in the stream-management UI. The TLS peer-certificate DN is rendered without escaping, allowing injection of malicious HTML/JavaScript. This requires a non-default configuration with a stream TLS listener using verifypeer and an attacker-obtainable trusted certificate with a malicious DN.

RabbitMQ versions 4.2.0 to 4.2.8 and 4.3.2 contain a vulnerability in get_auth_mechanism/1, which uses term_to_binary/1 on the strict_auth_mechanism or preferred_auth_mechanism atom when clearing the corresponding cookie. This produces a non-ASCII cookie name that violates RFC 6265 and can prevent the browser from deleting the preference. The issue is not directly exploitable for code execution but affects the persistence of preferences across logout and login cycles.