CVE Vulnerability Catalog

In RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, the /federation-links/.../restart route uses is_authorized_monitor which accepts the monitoring tag, and DELETE triggers a federation link restart without an elevated permission check. A monitoring-tagged user can restart any federation link.

In RabbitMQ, match_value/3 passes the user-supplied ?name= regular expression to re:run with no match_limit option and executes it once per resource in the result set. With a large result set, a single request can consume many minutes of CPU, and parallel requests saturate the schedulers. The path is reachable through normal API use with the use_regex=true option.

In RabbitMQ, get_chunk_selector/1 calls binary_to_atom on the raw client-supplied <<"chunk_selector">> property from post-auth subscribe and resolve_offset_spec frames, with no whitelist and no existing guard. An authenticated stream client with read access to any stream can crash the broker node.

In RabbitMQ prior to versions 4.1.13, 4.2.7, and 4.3.0, is_authorized/2 uses is_authorized_monitor for all methods, and DELETE resets authentication attempt counters. A monitoring-tagged user can reset these counters via DELETE /api/auth/attempts/:node, erasing evidence of brute-force activity.

In RabbitMQ, the ?LOG_DEBUG macro formats the entire Shovel state map, including the 'uris' field holding decrypted URIs with credentials. With DEBUG logging enabled, autodelete-shovel completion writes the full state map, including amqp://user:password@host/, to the broker log file.

In RabbitMQ, the stream open handler calls only check_vhost_access, omitting the node/vhost/user connection-limit checks that rabbit_reader performs for AMQP. An authenticated tenant can fully bypass operator-configured per-user and per-vhost connection caps by connecting via port 5552 instead of 5672.

A vulnerability was found in the sfturing hosp_order project in an unknown function of ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java. Manipulation leads to cross-site request forgery, and the attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

An argument-injection flaw exists in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without integer validation, and the dispatcher flattens the management-command argument list into a single space-separated string, so spaces become additional arguments. An authenticated superuser can inject arbitrary arguments, including Python's path option, into the awx-manage process.

A server-side request forgery flaw exists in the Ansible Automation Platform automation-controller email notification backend. The backend passes the user-supplied SMTP host and port from a notification template directly to the SMTP client without validating that the target is not an internal, loopback, link-local, or reserved address. An authenticated user with organization notification-admin permission can create a template pointing at an arbitrary internal address and trigger a test, opening a raw TCP connection.

In Ansible Automation Platform automation-controller, the WorkflowJobNode.ancestor_artifacts database column, storing raw merged set_stats artifacts propagated between workflow nodes, is not wrapped in prevent_search() and is accepted for arbitrary field lookups by the REST filter backend, even though it is omitted from the API serializer. Because the column is persisted before Ansible's no_log masking is applied, a user with read access to a workflow can use the result count as an oracle to recover, character by character, values marked no_log.

In Ansible Automation Platform automation-controller, in the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying it originated from a trusted proxy, and selects the leftmost (attacker-controlled) header value. An attacker can forge the source IP address recorded in the Controller's audit and access logs.

In Ansible Automation Platform automation-controller, the unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after looking up the target template, returning HTTP 200 for a template with a Bitbucket DC webhook configured and HTTP 403 otherwise. An unauthenticated remote attacker can use this response discrepancy as an oracle to enumerate which Job Template and Workflow Job Template IDs have Bitbucket DC webhooks configured, without knowing the secret webhook_key.

A flaw exists in the automation-controller install-bundle endpoint. A System Administrator can register a case variant of an existing control node's hostname and obtain an X.509 certificate signed by the receptor mesh CA, valid for ten years, with no issuance log or revocation list. Because the hostname charset validator is case-insensitive while the uniqueness validator is case-sensitive, TLS peers accept the certificate as that control node.

A flaw in the automation-controller notification subsystem causes the recipient value from NotificationTemplate.notification_configuration to be copied in clear text into the unprotected Notification.recipients field on every send. Because the credential-types endpoint is listable by any authenticated user and the API filter backend traverses object relations without per-hop authorization, a user with no privileges can use a relational filter as a boolean count-oracle to recover, character by character and across organizations, the secret recipient values of other tenants' notifications, including PagerDuty service keys and Slack/Mattermost/RocketChat/Webhook bearer-token URLs. This flaw affects confidentiality.

In the automation-controller API, the unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory (node hostnames, node types, UUIDs, heartbeats, capacities, and exact versions), all instance-group names and membership, the deployment install UUID, and the active control node. A remote, unauthenticated attacker can use this to map the control plane and fingerprint software versions for targeted attacks. This flaw affects confidentiality only; it does not expose secrets, credentials, or tenant data.

In RabbitMQ prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ETF-encoded binary and calls binary_to_atom(Node, utf8) on the node-name field. It is reached from rabbit_volatile_queue:pid_from_name/2, which is invoked for any queue name or routing key beginning with amq.rabbitmq.reply-to.. The CandidateNodes membership check happens after the atom is created, and the surrounding try/catch cannot reclaim atoms (they are never GC'd). Any authenticated AMQP client can crash the entire Erlang VM (all vhosts, all connections) with ~1M cheap requests.

In RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, the /api/queues/quorum/:vhost/:queue/status handler reads the vhost from the path without checking user access, using is_authorized/2 instead of is_authorized_vhost/2. A management-tagged user can read Raft status for quorum queues in inaccessible vhosts.

In sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8, a flaw exists in an unknown part of the file ssm_pro/src/main/resources/jdbc.properties, causing hard-coded credentials. The attack can be initiated remotely, its complexity is rated high, and exploitability is indicated as difficult. The exploit has been published and may be used. This product uses a rolling release for continuous delivery, so no version details for affected or updated releases are available. The project was informed early via an issue report but has not responded.

An out-of-bounds heap read flaw exists in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in.

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1.