CVE Vulnerability Catalog

Progress MarkLogic Server before 12.1.0 (12.x) and 11.3.7 (11.x) contains a cross-site scripting vulnerability that allows a remote attacker to execute script in the context of an authenticated user's browser session, leading to unauthorized actions or information disclosure.

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive information. A remote authenticated attacker with limited management permissions could obtain this information, which could result in unauthorized access to protected resources.

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that could result in memory corruption, controlled process failure, or server instability.

A vulnerability in Progress MarkLogic Server before versions 12.1.0 and 11.3.7 allows an authenticated Query Console user to supply unsafe path values to a privileged filesystem helper, potentially resulting in disclosure of arbitrary server files.

Progress MarkLogic Server before versions 12.1.0 and 11.3.7 includes deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially resulting in unauthorized access to protected information.

Progress MarkLogic Server before versions 12.1.0 and 11.3.7 contains an improper authentication vulnerability in SAML processing. In deployments using SAML authentication, an unauthenticated remote attacker could cause the server to accept an assertion that should be rejected, potentially resulting in unauthorized access.

On Azure deployments, Progress MarkLogic Server before versions 12.1.0 and 11.3.7 may record security-sensitive authentication information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain unauthorized access to protected cloud resources.

Progress MarkLogic Server before versions 12.1.0 and 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures an authenticated Query Console user to a malicious page could submit unauthorized requests and execute server-side code with the victim's permissions.

Progress MarkLogic Server before versions 12.1.0 and 11.3.7 do not consistently record successful authentication events in audit logs, which could limit customers' ability to detect and investigate unauthorized access or credential misuse.

Progress MarkLogic Server before versions 12.1.0 and 11.3.7 contain an authentication validation weakness that could allow an attacker to use a token that should not be accepted by the affected server, which could result in unauthorized access.

Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which could result in unintended network access or information disclosure.

ExLlamaV3's EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without verifying bounds. A malicious model can force out-of-range function pointer read/invoke, causing reproducible crash. Under specific conditions, controlled indirect kernel dispatch may be possible.

A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading to the disclosure of sensitive information through error messages or enabling blind port scanning within the cluster.

ZITADEL 3.0.0 through 4.19.1 has a privilege escalation vulnerability in OIDC token exchange that allows impersonation of administrators, including IAM_OWNER, by bypassing admin impersonation checks. Attackers holding IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR roles can sign in to relying applications as administrators.

ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them with empty tokens to receive rotated tokens, taking over accounts including MFA-completed administrator sessions.

ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback. The assertion signature is verified using the provider named in the request URL, but the user is resolved from the login intent without checking they match. Attackers with organization-administrator permission can register a SAML provider with their own signing key to obtain authenticated sessions as any user linked to another SAML provider on the instance, including in other organizations.

ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow before any factor is verified. Unauthenticated attackers can submit a victim's login name and then post a new username to rename any active human user, including administrators, locking them out.

Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated peers to force dropping of new blocks without penalty. Attackers can serve a real block with a coinbase scriptSig rewritten to height 1, which keeps the ZIP-244 block hash, triggering a behind-tip drop before consensus validation and delaying tip discovery for mining backends.

Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving forged block bodies with valid header hashes. Attackers can flip authorizing-only bytes such as a coinbase scriptSig, wasting Sapling, Orchard, and Ironwood proof verification without penalty and stalling sync for 67 seconds.

Zebra versions 2.3.0 through 6.3.1 have a protection mechanism failure that lets unauthenticated peers evade bans because bans and misbehavior scores are keyed on exact IP addresses. Attackers can reconnect from fresh IPv6 addresses in their /64 allocation or flush the 20,000-entry FIFO ban list to restore access for banned peers.