CVE Vulnerability Catalog

Insertion of sensitive information into log file vulnerability in Apache Syncope. When an AES key of non-standard length (not 16/24/32 bytes) is configured, Syncope will pad the provided value with random characters, and the resulting key value is logged.

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The media rename task applied neither of the directory boundary checks used by the folder operations in the same controller, and its validation guard required only that either a media record exist for the supplied identifier or that the supplied path be present in #__spmedia, rather than both. The identifier and the path were consequently never checked against one another, so any valid media identifier could be paired with an unrelated filesystem path, and the STR input filter left traversal sequences intact. An attacker could rename files elsewhere in the installation, including renaming configuration.php to take the site offline.

Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0 - plgContentSppagebuilder::onContentAfterSave() read jform[attribs][sppagebuilder_article_id] from the request and concatenated it directly into the WHERE view_id = ... clause of a query against #__sppagebuilder without quoting or type casting. Joomla's ARRAY input filter does not sanitise element values, as InputFilter::clean() returns (array) $source with the elements untouched, so the entire payload could be delivered in a single POST field. The affected block also executed before the com_content.article context test, so it ran on every onContentAfterSave event regardless of which component triggered the save. An attacker could perform time-based blind SQL injection to read arbitrary database contents, including the #__users and #__session tables.

A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions.

Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies. The patch shows that CLI access could differ from the web application in multiple security-sensitive areas:  - feed listings did not enforce the same lookup_visible restrictions for non-host-organisation users;  - feed detail access did not enforce the same host-organisation/site-admin authorization as FeedsController::view();  - Feed.headers, which can contain HTTP authorization credentials, could be exposed instead of being hidden or masked;  - server synchronization authkey values were not explicitly hidden from CLI detail output;  - sharing-group detail access did not consistently use SharingGroup::checkIfAuthorised();  - the use command could establish context for a record without first proving that the user was authorized to view that record The commit additionally hardens pagination and terminal rendering, including neutralization of terminal control sequences found in database-backed values. Those are important hardening changes, but the main vulnerability is the CLI authorization/data-disclosure mismatch. Version affected: ≤2.5.45

Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrv_InstallAppliance lets you pick the appliance folder (sVmParentPath). The daemon unpacks with one string, tar -xf "%1" -C "%2", then Qt QProcess::splitCommand chops that string into words. A quote in the folder name closes early. The leftover text becomes extra tar flags. macOS tar --use-compress-program= runs the named program as root.

A vulnerability was detected in subhajitkhan online-clinic-management-system in the file listdoctor.php. Manipulation of the searchtext argument leads to SQL injection. The attack may be initiated remotely and the exploit is publicly available.

An Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to. This issue affects Apache Doris versions 3.1.0 through 3.1.*, 4.0.0 through 4.0.7, and 4.1.0 through 4.1.3.

A local privilege escalation vulnerability in the Logitech Logi Options+ updater service on Windows allows a low-privileged local user to execute arbitrary code as SYSTEM.

A security vulnerability has been detected in 0x4m4 HexStrike AI in the FileOperationsManager function of hexstrike_server.py (API Files Endpoint component). Manipulation of the filename argument leads to path traversal. The attack may be initiated remotely and the exploit has been publicly disclosed.

A weakness has been identified in 0x4m4 HexStrike AI in the subprocess.Popen function of hexstrike_server.py (API Tools Endpoint component). Manipulation of the additional_args/target/username/password/scan_type/payload arguments can lead to OS command injection. The attack can be launched remotely and the exploit has been made available to the public.

A security flaw has been discovered in Tenda W20E 15.11.0.61068_1546_841_CN_TDC in the formDelWebAuthWhiteUser function. Manipulation of the webAuthWhiteUserIndex argument results in a stack-based buffer overflow. The attack can be initiated remotely.

Joomla Extension Modals Pro (regularlabs.com) versions < 17.0.0 contains a privileged stored XSS vulnerability via the event handler option. The extension supports JavaScript events such as on-open and on-closed but does not distinguish trusted configuration from event code supplied in article content. A lower-privileged author can use this feature to inject malicious code.

Joomla Extensions Snippets Free (< 7.0.0) and Snippets Pro (< 11.0.0) from regularlabs.com contain a privileged stored XSS vulnerability via the url option. Snippets substitutes variable values supplied by an article tag into saved Snippet content without considering the article author's trust level. A lower-privileged author can place an unsafe value into a security-sensitive position chosen by the trusted Snippet author.

Joomla Extension Articles Anywhere (regularlabs.com) versions < 20.0.0 contains a privileged stored XSS vulnerability via the link option. The extension accepts link options such as onclick and onmouseover, which in affected versions become real HTML event attributes without checking the article author's trust level. The plugin syntax survives Joomla's normal Author content filter because the executable HTML is generated later.

Joomla Extension Tabs & Accordions (regularlabs.com) versions < 3.1.0 contains a privileged stored XSS vulnerability via the rtla-alias option. The extension rewrites links matching an item alias into calls to its browser API. The affected renderer places the alias inside a quoted JavaScript argument in an HTML onclick attribute without securing both the JavaScript-string and HTML-attribute contexts. A crafted data-rlta-alias value can therefore change the generated handler.

Joomla Extension Quick Index (regularlabs.com) versions < 5.0.5 contains a privileged stored XSS vulnerability via the class option. The extension inserts configurable class values into generated HTML without escaping them for an HTML attribute. A crafted value can close the intended class attribute and introduce a new attribute. Joomla's content filter cannot reliably prevent this because Quick Index creates the executable HTML after the authored plugin syntax was filtered.

The Modals extension for Joomla (regularlabs.com) below version 17.0.0 treats destinations using executable browser URL schemes as ordinary modal URLs. The value can reach both the generated link and the iframe-loading path, enabling privileged stored XSS without using the separate Pro JavaScript Events feature.

SolarView Compact contains an OS command injection vulnerability in Schedule Settings. An attacker who can log in to the product may execute arbitrary OS commands.

An unrestricted upload of a file with a dangerous type exists in the Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. A remote authenticated attacker can upload a specially crafted file, potentially leading to arbitrary code execution on the product.