CVE Vulnerability Catalog

Vulnerability in Open edX Platform involves lack of sanitization of discussion-title values in add_additional_attributes_to_notifications, allowing an enrolled student to place CSS-capable markup in post titles. This markup is rendered as safe HTML in email digests, enabling email-open tracking and content spoofing or phishing.

Vulnerability in Suricata allows treating IPv4 and IPv6 flows as equal without comparing IP family when raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket align. This can cause incorrect flowbit state, detection bypass, or IP-only bypass.

Vulnerability in Suricata's SMB parser can retain force-completed transactions on flows with one-directional payload, leading to unbounded per-flow state and CPU/memory exhaustion. Sustained one-directional SMB traffic can be exploited.

Vulnerability in microsandbox exposes network config secrets and environment variables via command-line arguments, readable by other local users through process listings. This can disclose API keys, tokens, and other secrets on shared hosts, CI runners, and developer systems.

Vulnerability in Suricata's SMTP MIME parser does not fully reset state when processing Content-Type: message/rfc822 encapsulation, allowing crafted mail to evade detections based on file.data, file.name, or extracted URLs.

Vulnerability in Cotonti fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages attributed to authenticated victims and send them to the administrator inbox.

Vulnerability in Cotonti fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit permissions to store redirects to arbitrary external hosts, which can be used for phishing.

Vulnerability in Cotonti fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Malicious pages can auto-submit POST requests to modify stored rating data.

Vulnerability in Cotonti is an open redirect in cot_url_check() using a regex without end-of-string anchor. Attackers can bypass the redirect guard by supplying hostnames beginning with the site domain to redirect users to attacker-controlled hosts.

SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails to validate chunk_idx from ZMQ STAGING_REQ frames in prefill/decode disaggregation deployments. Attackers with access to the decode engine's internal ZMQ rank port can send a frame with an extremely large chunk_idx value, causing the scheduler to allocate memory until the system runs out and terminates the process.

A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files.

A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can redirect these operations to unintended files. This could lead to unauthorized changes in file ownership and permissions on arbitrary files, potentially compromising system integrity and availability by altering system or application states or rendering services unusable.

A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory, leading to a compromise of data integrity. In some cases, this could also lead to reduced confidentiality if the new ownership grants unauthorized read access. Exploitation requires user interaction to select a non-original owner during the paste operation.

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary JavaScript code due to improper neutralization of input during web page generation.

IBM Guardium Data Protection 12.2 could allow an authenticated user to execute arbitrary commands with low user privileges on the system due to improper validation of user supplied input.

Autobahn Python prior to 26.7.1 contains a vulnerability in WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize, where the limit is enforced on the compressed frame length before inflation but not rechecked after decompression. A remote unauthenticated client can send a valid compressed frame below the wire-size limit that expands beyond the application message limit, causing oversized data to be allocated and processed, potentially leading to resource exhaustion.

CordysCRM prior to 1.7.4 contains a vulnerability in the /attachment/preview/{id} and /pic/preview/{id} routes, which are configured as anonymous and call AttachmentService.getResource without ownership, organization, or permission checks. An unauthenticated attacker who guesses or observes an id generated by IDGenerator.nextStr can download files uploaded by users in other organizations.

CordysCRM prior to 1.7.4 contains a vulnerability in the GET /pool/lead/get/{id} and GET /pool/account/get/{id} routes, which use bare pool-read permission checks without the CsPermission resourceId binding that enforces per-record data scope. An authenticated user with the ordinary CLUE_MANAGEMENT_POOL:READ or CUSTOMER_MANAGEMENT_POOL:READ permission can supply another record's id and cause unscoped primary-key getters to return leads or accounts owned by other users, departments, or organizations. Exposed data includes contact names, phone numbers, owner and department attribution, and custom field values.

CordysCRM version 1.7.3 contains an SSRF vulnerability in ApprovalResourceService.sendWebHook, which reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it to HttpClientUtils without the SSRF validation. A user with PROCESS_SETTING_ADD can configure an internal URL through POST /approval-flow/add, and the server will request it when POST /approval-action/approve executes, enabling cloud metadata access, internal network reconnaissance, and interaction with reachable internal services.

CordysCRM versions 1.7.0 through 1.7.4 contain a SQL injection vulnerability in the POST /account-pool/page endpoint. An authenticated caller with MODULE_SETTING_UPDATE can place an arbitrary database function in SortRequest.name because Spring request validation is missing and the blacklist is incomplete. Functions such as extractvalue and updatexml can expose database values through an error oracle.