CVE Vulnerability Catalog

MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer's OpenLayers HTML output for SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value without escaping it for a single-quoted JavaScript string. When the deployment trusts the forwarded header and does not configure a fixed ows_onlineresource or MS_ONLINERESOURCE value, embedded single quotes can escape the generated URL string. An unauthenticated attacker can craft a URL that executes arbitrary JavaScript in the MapServer site origin when opened by a victim. This issue is fixed in version 8.6.4.

Metacat is data repository software for researchers. MetacatSolrIndex.query forwards the client-controlled qt parameter through Apache SolrJ from search endpoints such as /d1/mn/v2/query/solr/ to its privileged Solr backend. An unauthenticated client can select the /admin/file handler, and SolrJ reformats the parameter into a request accepted even when handleSelect=false is configured on Solr 7.0 or later. When Solr returns the selected core configuration file, Metacat embeds the raw content in an XML processing error response, disclosing internal files such as solrconfig.xml. This issue is fixed in version 3.4.2.

Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in colorpicker_more.aspx. A remote, unauthenticated attacker can craft a URL that, once opened by a victim in a browser session authenticated to a site running the vulnerable component, executes arbitrary JavaScript in the security context of that site.

A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript in the file server/internal/machine/api/machine_script.go of the Machine Script Feature component. The manipulation of the argument params results in OS command injection. The attack can be executed remotely, and the exploit is now public. Exploitation needs no admin account — any account holding machine:script:run plus tag access reaches arbitrary command execution on machines whose templates contain {{.param}} placeholders. The vendor did not respond to the disclosure.

If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwords and AWS secure access keys. This may lead to unauthorized access to protected resources.

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption. This may lead to protected fields being stored unencrypted.

Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database.

In the OmniBlocks project, the GitHub Actions workflow disc.yml ran on the issues opened and issues edited events and invoked the createDiscussion mutation whenever an issue was classified as off-topic, without recording that the issue had already been converted. A user could repeatedly edit the description of a single off-topic issue before conversion completed, causing multiple discussions to be created for the same issue. The issue is fixed with commit 627e0f0a16a7d74b09128106b57dd7e85d2545df.

OpenFeature Operator version 0.9.2 and earlier allows a tenant who can create a controller-owned workload to use the openfeature.dev/featureflagsource annotation with NAMESPACE/NAME syntax to reference a FeatureFlagSource or InProcessConfiguration in another namespace. On multi-tenant clusters, the cluster-scoped operator reads that resource and materializes spec.envVars literal values, spec.httpSyncBearerToken, sync URIs, and supporting ConfigMaps into the tenant's workload. Single-tenant clusters are not impacted, and secretKeyRef and configMapKeyRef values remain namespace-local.

A vulnerability was detected in Dromara mayfly-go up to 1.11.5 in an unknown function of the file server/internal/ai/api/ai.go in the AI Assistant component, leading to missing authorization. Remote exploitation is possible, and the exploit has been publicly disclosed. The whitelist bypass is one-token wide — any compound command containing curl, wget, or sed auto-runs without approval, and approval is granted by the same session user (self-approval).

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic group-parent hierarchy and request a trips or stops report for a device in that hierarchy. GroupResource permits the parent cycle, while AttributeUtil.lookup follows group parents without cycle detection, a visited set, or a depth limit, causing the lookup to never terminate, pinning a Jetty worker at high CPU and potentially exhausting the web/API worker pool when requests are repeated.

A vulnerability was found in SourceCodester Drug Recommendation System 1.0 affecting some unknown processing of the file /db/drug_recommendor.sql, resulting in information disclosure. The attack can be carried out remotely, and the exploit has been made public and could be used.

Verizon Cloud for Android (com.vcast.mediamanager) before 26.7.10 contains a path traversal vulnerability that allows co-resident malicious applications to write attacker-controlled bytes outside the intended staging directory by supplying a crafted _display_name value containing path-traversal sequences through exported activities OneTouchUploadActivity and PrintShopCloudActivity. Attackers can exploit the unsanitized filename concatenation in the file-staging sink via ACTION_SEND or ACTION_SEND_MULTIPLE intents to achieve arbitrary file write and inject attacker-controlled content into the authenticated user's Verizon Cloud account without user interaction.

Scoold is a Q&A and knowledge sharing platform for teams. Prior to 1.69.0, authenticated users who are not members of a private space can create content in questions belonging to that space because QuestionController.reply() and CommentController.createAjax() do not apply the canAccessSpace authorization check used by the question read path. With scoold.is_default_space_public set to false and private spaces in use, a user with a valid session and a known or enumerable question identifier can send requests to POST /question/{id} and POST /comment, causing replies and comments to be stored in a thread the user cannot read.

Scoold is a Q&A and knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot access because ApiController.getPostReplies() does not apply canAccessSpace before returning data from GET /api/posts/{id}/answers. The issue is reachable when scoold.api_user_access_enabled and scoold.api_enabled are true and a token holder knows or enumerates a private question identifier. Under those conditions, the question endpoint can deny access while the answers endpoint returns the private reply bodies.

WireGuard Portal (wg-portal) is a web-based configuration portal for WireGuard server management. From 2.2.0 until 2.3.0, the authenticated GET /api/v0/ws statistics WebSocket subscribes to TopicPeerStatsUpdated and TopicInterfaceStatsUpdated and forwards every TrafficDelta event without per-user authorization in handleWebsocket(). A low-privilege user can enumerate peer public keys through EntityId and monitor BytesReceived and BytesTransmitted values for peers belonging to other users. The same connection exposes interface_stats and interface names that the REST API limits to administrators.

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to 13.22.1, the authenticated PUT /api/basemap endpoint passes an attacker-controlled URL through importBasemapURL() to fetch(url) without resolved-address classification or redirect revalidation. BasemapProtocol.isValidURL checks only the HTTP or HTTPS scheme and is not applied on the vulnerable import path. Direct internal addresses, alternate IP encodings, and redirects to internal addresses can reach cloud metadata, loopback, private, and CGNAT HTTP services. The OptionalTileJSON response reflects fields including name, attribution, and tiles[0] to the caller, making the request forgery full-read rather than blind and enabling cloud credential theft and internal service disclosure.

rabbitmq-c before version 0.16.0 contains an unsigned size_t underflow in amqp_handle_input() in librabbitmq/amqp_connection.c. A malicious AMQP server can send an undersized HEADER or METHOD frame during client login, leading to an out-of-bounds read and process crash. The issue also occurs when AMQP traffic is not protected by TLS with certificate validation.

Initializing the DNS stub resolver from /etc/resolv.conf or LOCALDOMAIN with a search list containing a domain of roughly 200 characters or more in GNU C Library versions 2.26 to 2.44 results in an assertion failure that aborts the process. The resolver truncates the search list when copying into the fixed-size _res.defdname buffer, but the consistency check compares against the wrong size and does not handle a first entry that does not fit, causing the assertion to fail.

The AsyncHttpClient (AHC) library versions 2.0.0 to 2.16.1 and 3.0.12 can leak origin credentials when using an HTTP proxy to reach an HTTPS origin. NettyRequestFactory and NettyRequestSender.sendRequestWithNewChannel attach Authorization to the plaintext CONNECT request before the TLS tunnel exists, exposing Basic or Digest credentials and per-connection NTLM, Kerberos, or SPNEGO tokens to the proxy and observers on the client-to-proxy hop.