CVE Vulnerability Catalog

An authentication bypass vulnerability in Capgo before version 12.128.2 allows attackers to change user passwords without requiring current password confirmation. This flaw can be exploited by attackers with temporary session access.

A vulnerability in Capgo before version 12.128.2 discloses information via the get_orgs_v7(userid) RPC function, which remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user UUIDs to retrieve foreign users' organization membership, roles, management emails, and billing metadata.

Crawl4AI before version 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation. An attacker can supply webhook URLs pointing to private or internal IP ranges, Docker networks, or cloud metadata endpoints (e.g. 169.254.169.254), causing the server to make requests to internal services and potentially expose cloud metadata.

The vulnerability in @capgo/capacitor-updater before version 12.128.2 distributes the private key to each device downloading the app. This allows an attacker performing a man-in-the-middle attack or compromising the Capgo server to create a validly signed update bundle and force devices to install unauthorized updates.

The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and exact firmware version.

The iDirect iQ200 device does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie lacking the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an authenticated administrator, automatically submits a cross-site POST request causing an immediate device reboot and satellite link loss.

Lucee CFML Server versions 5.3.x, 6.1.x, 6.2.x, and 7.0.x contain a reflected cross-site scripting vulnerability in URL path parsing. An unauthenticated remote attacker can embed HTML/JavaScript payloads in the request path, which are reflected in the server response without proper output encoding. This allows session hijacking or unauthorized actions against the Lucee administrative interface when a victim visits a crafted link.

FlaskBB through version 2.2.0 contains a logic flaw vulnerability that allows authenticated administrators to delete all built-in authorization groups. The issue is a type mismatch in the bulk AJAX endpoint, where JSON integer group IDs are compared against string literals, causing the protection check to always pass.

FlaskBB through version 2.2.0 contains an authorization bypass vulnerability that allows authenticated moderators to perform unauthorized actions on topics in forums they do not control by submitting crafted topic ID lists. Attackers can include a low-ID topic from a permitted forum as an anchor in a batch request, causing the permission check applied only to the first result to pass, and then execute lock, unlock, delete, or hide actions against topics in unmoderated forums.

Deserialization of untrusted data vulnerability in Dell Unisphere for PowerMax versions 10.3.0.5 and prior. A low-privileged attacker with remote access can exploit this to execute arbitrary commands with root privileges.

Dell PowerFlex Manager versions prior to 5.1.0.1 contain an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. A low-privileged attacker with remote access could exploit this flaw, leading to information disclosure, information exposure, and unauthorized access.

An SQL Injection vulnerability in Dell PowerFlex Manager prior to version 5.1.0.1 allows a low-privileged attacker with remote access to inject malicious SQL code, leading to information exposure.

The vulnerability in R-SOFT DMS stores superadmin credentials using a non-salted nested MD5 hash. This allows an attacker who obtains the password hash to decode superadmin credentials. Critically, this password cannot be changed except by modifying the configuration file.

An IDOR vulnerability in R-SOFT DMS allows unauthorized file access by manipulating IDs in download requests. The system does not verify user permissions for specific files, relying solely on session authentication.

OS Command Injection vulnerability in the konwertujAction() function of R-SOFT DMS allows an authenticated attacker to execute arbitrary system commands with the privileges of the web server user. The issue is fixed in versions v3.19-2752 and v3.17-2580.

An out-of-bounds read and improper input validation vulnerability in the Apache IoTDB C++ client causes crashes during TsBlock deserialization when processing malformed server data.

A vulnerability in Apache IoTDB allows unauthorized but authenticated users to access last-value data via the /rest/v2/fastLastQuery endpoint. The issue is caused by incorrect authorization and improper access control.

An uncontrolled recursion and resource consumption vulnerability exists in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the AirGap receiver's readLength method recursively calls itself without depth limit upon recognizing the E-language prefix in socket data. An unauthenticated attacker can send a stream of repeated E-language prefixes, causing a JVM stack overflow and StackOverflowError.

In Apache IoTDB with AirGap mode enabled (pipe_air_gap_receiver_enabled=true), the pipe receiver accepts unauthenticated TCP connections on port 9780. An attacker can send a controlled 32-bit integer used as memory allocation size without an upper bound, causing JVM heap exhaustion and crashing the DataNode process.

The Hide My WP Lite plugin for WordPress up to version 1.3 is vulnerable to Arbitrary File Read. Attackers can exploit the he_wrapper_js and he_wrapper_css parameters processed by the elementor_assets_filter() function without path validation, allowing reading of files like wp-config.php.