CVE Vulnerability Catalog

Hatchet before version 0.91.1 has an SSRF vulnerability in the SNS UnsubscribeConfirmation handler. An authenticated tenant can replace the UnsubscribeURL field in a valid AWS-signed message with an internal URL, allowing server-side requests to EC2 Instance Metadata Service, internal services, and internal HTTP APIs. This may expose IAM credentials or network-accessible data and functionality.

CuteNews v2.1.2 is vulnerable to XSS in the __referer value. An attacker can execute arbitrary JavaScript in the context of an authenticated user's session via a javascript: URI rendered as an unsanitized clickable link on the msg_info page.

Deserialization of Untrusted Data of the __post_data parameter in cn_parse_url() in CuteNews v.2.1.2 allows a remote attacker to inject arbitrary values into internal request variables (including __referer) via a crafted base64-encoded serialized PHP payload submitted as a POST parameter.

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php.

CuteNews v2.1.2 has a stored XSS vulnerability in index.php, where an unauthenticated attacker can supply an arbitrarily named URL parameter key containing an URL-encoded XSS payload, leading to script execution in the victim's browser.

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.

Ditty before version 3.1.70 has a stored XSS vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The rendering function inserts these values without allowlist validation, bypassing wp_kses_post() sanitization.

In Apache Airflow 3.3.0 and 3.3.1, there is an authentication precedence issue: when a request carries both a session cookie and an explicit Bearer token, Airflow resolves the caller from the cookie and ignores the token. This causes the request to execute as the cookie's principal rather than the token identity, leading to misattributed audit records.

The /assets/events API in Apache Airflow returns asset events for all DAGs without filtering according to the caller's permissions. Any authenticated user with asset-read access can enumerate events, including source DAG IDs, task IDs, run IDs, and timestamps, for DAGs they are not authorized to see. Even the total_entries and pagination disclose the existence of hidden DAGs.

nginx ignition (the UI for the nginx web server) in versions 2.33.0 through 2.35.0 has a vulnerability that allows a user with OTP 2FA enabled to reuse their TOTP during the standard 30-second validity window. Version 2.35.1 patches this issue.

GoCD from version 16.1.0 to 26.1.0 has a vulnerability in the internal material connection test APIs. A pipeline group administrator can invoke Test Connection for source control materials outside their authorized group and potentially use credentials from those materials. It may also resolve external secrets managed by secret-management plugins.

mport (the MidnightBSD Package Manager) before version 2.7.8 used TMPDIR while extracting package metafiles, even when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to an attacker-controlled location.

The /jobStatus.json API in GoCD before version 26.1.0 does not validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request. An authenticated user can guess job IDs and retrieve status for jobs in pipelines they cannot view, including job names, state, timestamps, agent IP addresses, and associated stages.

In GoCD from 12.3.1 until 26.1.0, legacy routes under /go/admin/restful/* expose historical full server configuration to pipeline group administrators instead of restricting responses to the groups they administer. The disclosed configuration can include agent auto-registration keys, webhook invocation keys, encrypted material credentials, and GoCD administrator lists.

In GoCD from 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline template by name without the required view permission and read its configuration.

In MISP, when a regular user adds a reference between objects or attributes, the system checks whether the user can access the overall event but does not always check whether the individual pieces of data are also allowed for that user. A user who can view an event could potentially access attributes or objects inside that event that were meant to be restricted to a specific sharing group or distribution level.

In MISP, when a user creates or edits a report inside an event, the system can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event. A user with editing rights on one event could move a report from another event into their own event if they know or can guess the report's UUID, then view and change information they were not originally allowed to access.

Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where old_value and new_value entries are rendered without proper escaping. Any user permitted to edit tracked text fields can inject malicious markup that executes when other users, including administrators, view the record's Chatter panel.

Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to register alert rules and receive notifications disclosing target system names and metrics.

UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE_AGENT can enumerate saved reply identifiers and read content reserved for groups and teams they do not belong to.