CVE Vulnerability Catalog

A vulnerability in TaleLin lin-cms-spring-boot up to 0.2.1. The searchBook function in BookController.java of the book Endpoint leads to improper authorization. The attack can be launched remotely. The exploit is publicly available.

A vulnerability in TaleLin lin-cms-spring-boot up to 0.2.1. The getBooks function in BookController.java of the book Endpoint leads to improper authorization. The attack can be launched remotely. The exploit has been publicly disclosed.

SigNoz versions from v0.98.0 up to v0.143.0, when configured with the opaque session tokenizer, do not revoke a user's existing login sessions when the user's password is reset with a reset token or when the user is deleted. An attacker who already holds a session token retains full access to the account, up to administrator, after a password reset until the token reaches its maximum lifetime (30 days by default), and after user deletion until the token next rotates (30 minutes by default).

A vulnerability was found in TaleLin lin-cms-spring-boot up to version 0.2.1 in the getBook function of BookController. Manipulation of the ID argument leads to improper authorization. The attack can be performed remotely and the exploit has been published.

A vulnerability was found in Forma LMS up to version 4.1.43 in the UserselectorAdmController::getDataTask function. Manipulation of the Name argument causes SQL injection. The attack can be initiated remotely and the exploit has been publicly disclosed.

A vulnerability was found in SPON Communications IP Network Audio Device XC-9603 version 1.2.3_20181106 Build 107 in the loadCfg function. Manipulation leads to information disclosure. The attack can be launched remotely.

A vulnerability was found in Intelliants Subrion CMS up to version 4.2.1 in the iaUsers::authorize function. Manipulation of the $_SERVER['HTTP_REFERER'] argument causes open redirect. The attack can be performed remotely and the exploit has been made public.

A vulnerability was found in Intelliants Subrion CMS up to version 4.2.1 in the file /actions.json?action=assign-owner. Manipulation of the q argument leads to information disclosure. The attack can be executed remotely and the exploit has been released.

A vulnerability was found in kvcache-ai mooncake up to version 0.3.12/0.3.14-rc1 in the MasterService::GetReplicaListByRegex function. Performing a manipulation leads to allocation of resources. The attack may be performed remotely and the exploit has been made public.

A vulnerability was found in kvcache-ai mooncake up to version 0.3.12/0.3.13.post1/0.3.14-rc1 in the ScopedSegmentAccess::MountSegment function. Performing a manipulation results in improper access controls. The attack can be performed remotely and the exploit has been released.

A vulnerability was found in SEMCMS up to version 4.2 in the file /Edit/php/upload_json.php. Manipulation of the imgFile argument causes cross site scripting. The attack may be initiated remotely and the exploit has been published.

GitLab has fixed an issue in GitLab CE/EE affecting all versions from 18.3 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1. Under certain conditions, an authenticated user with an MCP-scoped token could perform actions beyond the intended scope of that token due to improper authorization checks.

GitLab has fixed an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1. Under certain conditions, an authenticated user could spoof merge request authorship and attribute content to arbitrary existing users due to improper reliance on ephemeral cache state during Direct Transfer imports.

GitLab EE contains an improper authorization check that, under certain conditions, could allow an authenticated user with developer-role permissions to bypass admin-configured AI tool governance controls for workflows in namespaces they do not control. Affected versions are from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1.

A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. Affected by this vulnerability is the function chrome.runtime.onMessageExternal.addListener of the file static/background/index.js of the component External Message Handler. The manipulation of the argument body.url/paginationConfig/xPathConfig/body.urls/xPaths results in missing authorization. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A security vulnerability has been detected in weiqingwen spring-boot-forum up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f. Affected is the function validate of the file src/main/java/com/qingwenwei/util/NewUserFormValidator.java of the component Avatar Upload. The manipulation of the argument Username leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was identified in Fast FAC1900R 20190827_2.0.2. The impacted element is the function get_alias_name of the component uhttpd. Such manipulation leads to stack-based buffer overflow. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

A security flaw has been discovered in LB-Link BL-CPE600EU 5.8.13. This vulnerability affects unknown code of the file Mifi_config.bin of the component Configuration Backup Handler. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

The hpack library (HTTP/2 header encoding for Python) prior to version 4.2.0 does not bound variable-length integer decoding. Malformed input can trigger runaway computation with O(n^2) runtime, blocking further processing. The fix in version 4.2.0 restricts decoding to uint32.

IBM Concert versions 1.0.0 through 3.0.0 allows a remote attacker to traverse directories by sending a crafted URL request containing "dot dot" sequences. This enables viewing arbitrary files on the system.