CVE Vulnerability Catalog

A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() causes an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

Missing Authorization vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (GKS) allows collecting data from common resource locations. This issue affects versions before 2.0.

An authorization bypass vulnerability in Ontime through a user-controlled key allows exploitation of trusted identifiers. Affects versions up to 04052026.

An authorization bypass vulnerability in Ontime allows exploitation of trusted identifiers through a user-controlled key. The issue affects versions up to 04052026.

Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files. This issue affects MicroRealEstate through version 1.0.0-alpha3.

The vulnerability in MicroRealEstate stems from broken object-level access controls and the use of a deterministic pattern during random ID generation. This allows attackers to access documents uploaded by landlords or tenants without authorization.

MicroRealEstate is vulnerable to broken object-level access controls in its PDF generator functionality. This affects versions through 1.0.0-alpha3.

A vulnerability in MicroRealEstate allows attackers to bypass authentication due to a lack of token state management. This enables brute-forcing One-Time Passwords (OTP) to log in as any user.

The Frontend File Manager Plugin for WordPress up to version 23.6 does not validate a file path derived from user input before deleting the referenced file, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php) when guest upload mode is enabled. Deleting wp-config.php forces the site into its setup routine, which can be leveraged toward a full site takeover.

Coolify prior to version 4.0.0-beta.469 has a vulnerability in the executeInDocker() helper that wraps user-controlled commands in single quotes without escaping embedded single quotes. Attackers who can edit application settings can inject a single quote into docker_compose_custom_build_command or docker_compose_custom_start_command to break out of the quoted context and execute arbitrary commands on the managed server host during deployments, escaping the intended Docker container confinement.

Coolify prior to version 4.0.0-beta.474 has a vulnerability in the PostgreSQL initialization script that allows an authenticated user to write files outside the intended directory and achieve command execution through database initialization.

Coolify prior to version 4.0.0-beta.471 has a vulnerability where user-controlled persistent volume names are interpolated into shell commands executed on managed servers without escaping or validation. This allows an authenticated member to inject shell metacharacters and execute commands as root when volume operations are triggered.

In Coolify prior to version 4.0.0-beta.471, the GET /invitations/{uuid} endpoint can perform a state-changing password reset using an attacker-known invitation UUID. An attacker who can cause a victim to visit the crafted invitation URL can reset the victim's account password to a predictable value.

Coolify prior to version 4.0.0-beta.471 contains a shell command injection vulnerability. The LocalPersistentVolume.name field is interpolated directly into docker volume shell commands without proper shell argument escaping, allowing an authenticated user to execute arbitrary commands on managed servers when the resource is deleted.

In Coolify prior to version 4.0.0-beta.471, pre-deployment and post-deployment commands are single-quote escaped but then sent through SSH heredoc transport that preserves newlines, allowing an authenticated user to inject additional shell statements that execute on the remote server during deployment.

In Coolify prior to version 4.0.0-beta.471, the Livewire component Server\Resources exposes public methods (startUnmanaged, stopUnmanaged, restartUnmanaged) that accept a container ID parameter directly from the browser without sanitization. This parameter is interpolated into shell commands executed via SSH on managed servers, allowing any authenticated team member to execute arbitrary OS commands on remote servers.

Coolify prior to 4.0.0-beta.471 has a vulnerability in the database import Livewire component that allows an authenticated user to inject commands via the database import container name. Lack of locking and validation lets client-controlled container and server properties reach shell commands.

In Coolify prior to version 4.0.0-beta.466, the Logs::mount() component looks up resources by UUID without scoping the lookup to the current team, allowing an authenticated user to access logs for applications owned by other teams by supplying a victim resource UUID.

Coolify prior to version 4.0.0-beta.466 has a vulnerability where log drain secrets and environment values are interpolated into shell commands without proper encoding. This allows an authenticated user to inject commands executed on the host.

Coolify prior to version 4.0.0-beta.466 has a vulnerability due to insufficient validation of the sentinel_token setting used in shell commands. An authenticated user with access to server Sentinel settings can inject shell syntax and execute commands on the host when Sentinel is restarted.