CVE Vulnerability Catalog

A server-side request forgery flaw exists in the Ansible Automation Platform automation-controller email notification backend. The backend passes the user-supplied SMTP host and port from a notification template directly to the SMTP client without validating that the target is not an internal, loopback, link-local, or reserved address. An authenticated user with organization notification-admin permission can create a template pointing at an arbitrary internal address and trigger a test, opening a raw TCP connection.

In Ansible Automation Platform automation-controller, the WorkflowJobNode.ancestor_artifacts database column, storing raw merged set_stats artifacts propagated between workflow nodes, is not wrapped in prevent_search() and is accepted for arbitrary field lookups by the REST filter backend, even though it is omitted from the API serializer. Because the column is persisted before Ansible's no_log masking is applied, a user with read access to a workflow can use the result count as an oracle to recover, character by character, values marked no_log.

In Ansible Automation Platform automation-controller, in the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying it originated from a trusted proxy, and selects the leftmost (attacker-controlled) header value. An attacker can forge the source IP address recorded in the Controller's audit and access logs.

In Ansible Automation Platform automation-controller, the unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after looking up the target template, returning HTTP 200 for a template with a Bitbucket DC webhook configured and HTTP 403 otherwise. An unauthenticated remote attacker can use this response discrepancy as an oracle to enumerate which Job Template and Workflow Job Template IDs have Bitbucket DC webhooks configured, without knowing the secret webhook_key.

A flaw exists in the automation-controller install-bundle endpoint. A System Administrator can register a case variant of an existing control node's hostname and obtain an X.509 certificate signed by the receptor mesh CA, valid for ten years, with no issuance log or revocation list. Because the hostname charset validator is case-insensitive while the uniqueness validator is case-sensitive, TLS peers accept the certificate as that control node.

A flaw in the automation-controller notification subsystem causes the recipient value from NotificationTemplate.notification_configuration to be copied in clear text into the unprotected Notification.recipients field on every send. Because the credential-types endpoint is listable by any authenticated user and the API filter backend traverses object relations without per-hop authorization, a user with no privileges can use a relational filter as a boolean count-oracle to recover, character by character and across organizations, the secret recipient values of other tenants' notifications, including PagerDuty service keys and Slack/Mattermost/RocketChat/Webhook bearer-token URLs. This flaw affects confidentiality.

In the automation-controller API, the unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory (node hostnames, node types, UUIDs, heartbeats, capacities, and exact versions), all instance-group names and membership, the deployment install UUID, and the active control node. A remote, unauthenticated attacker can use this to map the control plane and fingerprint software versions for targeted attacks. This flaw affects confidentiality only; it does not expose secrets, credentials, or tenant data.

In RabbitMQ prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ETF-encoded binary and calls binary_to_atom(Node, utf8) on the node-name field. It is reached from rabbit_volatile_queue:pid_from_name/2, which is invoked for any queue name or routing key beginning with amq.rabbitmq.reply-to.. The CandidateNodes membership check happens after the atom is created, and the surrounding try/catch cannot reclaim atoms (they are never GC'd). Any authenticated AMQP client can crash the entire Erlang VM (all vhosts, all connections) with ~1M cheap requests.

In RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, the /api/queues/quorum/:vhost/:queue/status handler reads the vhost from the path without checking user access, using is_authorized/2 instead of is_authorized_vhost/2. A management-tagged user can read Raft status for quorum queues in inaccessible vhosts.

In sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8, a flaw exists in an unknown part of the file ssm_pro/src/main/resources/jdbc.properties, causing hard-coded credentials. The attack can be initiated remotely, its complexity is rated high, and exploitability is indicated as difficult. The exploit has been published and may be used. This product uses a rolling release for continuous delivery, so no version details for affected or updated releases are available. The project was informed early via an issue report but has not responded.

An out-of-bounds heap read flaw exists in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in.

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1.

Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.

Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.

Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions.

The Conekta Payment Gateway plugin in versions up to and including 6.2.4 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. The flaw involves improper access control on plugin functionality.

The WP User Frontend plugin in versions up to and including 4.3.11 contains an Arbitrary File Deletion vulnerability exploitable by a Subscriber-level user. The flaw stems from insufficient permission validation during file operations.

The WP User Frontend plugin in versions up to and including 4.3.11 contains a Bypass vulnerability exploitable by an unauthenticated attacker. The flaw allows bypassing the plugin's control mechanisms.

The WP User Frontend plugin in versions up to and including 4.3.11 contains a Bypass vulnerability exploitable by a Subscriber-level user. The flaw allows bypassing the plugin's control mechanisms.