CVE Vulnerability Catalog

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.

The MotoPress Hotel Booking plugin for WordPress in all versions up to and including 6.2.4 is vulnerable to Stored Cross-Site Scripting via the Stripe Webhook event object 'id' due to insufficient input sanitization and output escaping. The premium Stripe webhook listener only verifies the webhook signature when an optional Stripe signing secret has been configured; because that secret is empty by default, a forged webhook is accepted without cryptographic verification, and the attacker-controlled event object 'id' is written unescaped into the payment log and later echoed unsanitized when an administrator views the payment.

Denial-of-service vulnerability in the integrated web server of Hirschmann HiOS Switch Platform devices. A remote unauthenticated attacker can send a specially crafted HTTP(S) request to a specific endpoint that is processed incorrectly, causing an unintended reboot and temporary denial of service. The issue is fixed in versions 07.1.12, 08.7.10, 09.0.13, 09.3.03, 10.3.08, and 10.5.00.

An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process, Warm-Flow TaskService.skip, POST /workflow/task/completeTask components.

Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key. This may allow an attacker to decrypt or impersonate communication protected by this key.

An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request.

Vulnerability in CodeRAG before 1.3.1. The default sync flow invokes _sync_gradle, which prefers a repository-controlled gradlew or gradlew.bat file and passes it directly to asyncio.create_subprocess_exec without validating the file's content. A victim indexing an attacker-controlled repository executes attacker-supplied code with the victim's OS privileges, potentially leading to disclosure, modification, persistence, or DoS.

GeoLens prior to 1.2.3 contains multiple authorization flaws in read and link endpoints. The application authorizes only the resource named in the request URL and fails to re-authorize a second caller-influenced dataset reached through relationships, map layers, VRT sources, externalId lookups, or request bodies. Anonymous callers can obtain metadata, rows, vector geometries, raster pixels, and other data from private datasets via public maps, dataset relationship APIs, and the /collections/datasets/items endpoint.

Vulnerability in Pipelines-as-Code before 0.37.8, 0.39.6, 0.42.1, and 0.48.0. The GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events before signature validation or host confirmation. An unauthenticated attacker reaching the webhook endpoint can select an attacker-controlled host and cause the controller to send a locally signed GitHub App JWT to that service.

Vulnerability in XWiki Platform from 13.4-rc-1 through 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1. The Live Data edit REST API allows a user with page edit rights to change that page's rights without executing normal authorization checks. The user can grant script right and then execute dangerous Velocity scripts or send unfiltered HTML/JavaScript to clients.

Vulnerability in Contentful MCP Server before versions 1.7.19 and 0.4.5. export_space and import_space expose host, proxy, rawProxy, and insecure network options to LLM-controlled tool arguments and combine them with CONTENTFUL_MANAGEMENT_TOKEN. After enabling migration tools, a direct MCP call or prompt injection can redirect API requests and Authorization header to an attacker-controlled host.

Vulnerability in phosphor-net-ipmid, OpenBMC's IPMI implementation. An unauthenticated client can force the RAKP Message 1 handler to return early before overwriting the authentication object's defaults. The IPMI service then accepts a RAKP Message 3 with HMAC computed using a constant 20-byte 'userKey' initialized from '0penBmc' and an often-predictable 'bmcRandomNum'.

Vulnerability in phosphor-net-ipmid, OpenBMC's IPMI implementation. A logic flaw allows replacing the authorization context of an existing session with a target account while maintaining the original integrity and encryption keys, leading to privilege escalation without re-authentication.

Incorrect boundary conditions vulnerability in the Networking component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Mitigation bypass vulnerability in the Popup Blocker component of Firefox and Thunderbird. The flaw was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

A privilege escalation vulnerability in the Enterprise Policies component of Firefox and Thunderbird. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Incorrect boundary conditions vulnerability in the Safe Browsing component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Use-after-free vulnerability in the Widget: Gtk component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Sandbox escape vulnerability in the Widget: Win32 component caused by incorrect boundary conditions. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Sandbox escape vulnerability in the Widget: Win32 component caused by incorrect boundary conditions. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.