CVE Vulnerability Catalog

OpenBao prior to 2.6.0 has a vulnerability in vault/policy/acl.go where a broader wildcard ACL grant could be evaluated before more specific trailing-wildcard ACL paths with capabilities = ["deny"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could allow listing the denied path.

GoCD from 20.2.0 until 26.1.0 has a vulnerability where the internal pipeline structure API used for autocompletion returns its users-and-roles mode to regular authenticated users without requiring an administrator role. A lower-privileged user can enumerate configured user names and available role names.

GoCD from 20.2.0 until 26.1.0 has a vulnerability in the internal fetch-artifact auto-suggestion API at /go/api/internal/pipelines/**/upstream that does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy details and user-defined pipeline, stage, job, and artifact plugin reference names.

BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message. This can result in an out-of-bounds read.

BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers. This can lead to memory corruption.

BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check. This may allow unauthorized access.

BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read. This may lead to data disclosure or a crash.

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients. This may result in failure to block unwanted addresses.

Cinnamon's Kotaemon (all versions up to and including v0.12.0) multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and improper access controls. There are four handler methods in `libs/ktem/ktem/pages/chat/control.py` that load a Conversation record by its ID without comparing the requester's `user_id` to the conversation's owner `Conversation.user`. This allows any authenticated user to perform the following actions: 1. Read other user's chat transcripts, RAG retrieval history, AI-generated plots, and chat suggestions. 2. Permanently delete another user's conversation. 3. Rename another user's conversation. 4. Overwrite another user's conversation's chat suggestion list.

In Flatpak before 1.18.1, a malicious sandboxed application can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files to an arbitrary location. The file names and content are not attacker-controlled, making this difficult to exploit.

Plex Media Server before 1.43.3.10861 suffers from path traversal in '/system/agents/media/get' due to insufficient validation of the url parameter. An attacker with a valid session token can read arbitrary files accessible to the server user, including the PlexOnlineToken that grants full control.

PgBouncer through 1.25.2 lacks an upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server. A malicious or compromised PostgreSQL backend can cause uncontrolled CPU consumption in PgBouncer, and the key derivation cannot be interrupted in frontend builds.

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer.

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values reference whitelisted methods before passing them to frappe.call(). Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and read their return values.

CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property, together with attacker-controlled basePath and compressedFileName values, in a method=compress request.

CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property.

IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.