CVE Vulnerability Catalog

A vulnerability has been found in chatwoot up to 4.17.1. This impacts an unknown function of the file callbacks_controller.rb of the component Shopify OAuth. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor wraps the exporter with newBufferExporter(exporter, 1), and the poll loop calls queue.TryDequeue and bufferExporter.EnqueueExport before immediately signaling pollTrigger whenever the queue remains at or above batchSize. Because a failed nonblocking EnqueueExport leaves the queue length unchanged, the processor repeatedly retries without waiting for its ticker, exhausting CPU and degrading or denying service in the embedding process.

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but newGRPCDialOptions does not apply cfg.tlsCfg when creating gRPC transport credentials. The environment-only TLS path instead uses credentials.NewTLS with system roots and no configured client certificate, bypassing intended private CA pinning and mutual TLS unless the application also supplies WithTLSCredentials. A network attacker able to intercept or spoof the collector connection with a system-trusted certificate can read or alter log telemetry.

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process.

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated remote attacker to conduct an SQL or HQL injection attack. It is caused by insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker with valid administrative credentials could execute arbitrary SQL or HQL queries and access data they are not authorized to view or modify.

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated remote attacker to conduct an SQL or HQL injection attack. It is caused by insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker with valid administrative credentials could execute arbitrary SQL or HQL queries and access data they are not authorized to view or modify.

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated remote attacker to conduct an SQL or HQL injection attack. It is caused by insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker with valid administrative credentials could execute arbitrary SQL or HQL queries and access data they are not authorized to view or modify.

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated remote attacker to conduct an SQL or HQL injection attack. It is caused by insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker with valid administrative credentials could execute arbitrary SQL or HQL queries and access data they are not authorized to view or modify.

A vulnerability in the Online Certificate Status Protocol (OCSP) responder of Cisco ISE and Cisco ISE-PIC allows an unauthenticated remote attacker to cause an administrative reload of the OCSP responder certificate and key material. It is caused by missing authentication on a function of the OCSP responder. An attacker could send a crafted request to trigger the reload of certificate and key material on demand.

A vulnerability in an API of Cisco ISE and Cisco ISE-PIC allows an authenticated remote attacker to read specific files on the underlying operating system of an affected device. It is caused by improper restriction of XML external entity references (XXE). An attacker could send a crafted request to read files that the underlying process has permission to access.

A missing authentication vulnerability exists in the Policy Runtime Repository Table (PRRT) service of Cisco ISE and Cisco ISE-PIC. An unauthenticated remote attacker could send a crafted request to retrieve sensitive configuration information from an affected device.

Insufficient authentication on an internal interface exposed through the guest portal of Cisco ISE allows an unauthenticated remote attacker to submit forged posture status events into the endpoint posture pipeline. A crafted request can manipulate posture status on the affected system.

Missing authorization checks in the web-based management interface of Cisco BroadWorks CommPilot Application Software allow an authenticated remote attacker with low privileges to alter configurations. A crafted HTTP request can modify settings on select pages.

Insufficient validation of user-supplied input in the certificate import functionality of the Cisco ISE and Cisco ISE-PIC web-based management interface allows an authenticated remote attacker with administrative credentials to read arbitrary files. A crafted request can expose sensitive information.

Insufficient validation of directory traversal character sequences in a user-supplied path in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC allows an unauthenticated remote attacker to access protected files. A crafted request to the provisioning download service can expose sensitive information.

Improper validation of directory traversal character sequences during file upload in the web-based management interface of Cisco ISE and Cisco ISE-PIC allows an authenticated remote attacker with administrative privileges to write arbitrary files. A crafted file upload can write to arbitrary locations.

Improper validation of directory traversal character sequences in a user-supplied file path in the file management function of the Cisco ISE and Cisco ISE-PIC web-based management interface allows an authenticated remote attacker with administrative credentials to delete arbitrary files and directories. A crafted request can delete files on the underlying operating system.

SQL injection vulnerability in the REST APIs of Cisco ISE and Cisco ISE-PIC due to certain parameters being concatenated directly into SQL clauses without parameterization. An authenticated remote attacker with administrative credentials can send a crafted request to read information from the session database.

XML external entity vulnerability in the offline profiler feed service of Cisco ISE due to parsing attacker-controlled feed metadata with an XML parser that does not disable external entity resolution. An authenticated remote attacker with administrative credentials can upload a crafted offline feed package to read arbitrary files and issue requests to internal systems.

SQL injection vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of specific parameters that are concatenated into an SQL statement. An authenticated remote attacker with administrative credentials can send a crafted request to read information from the monitoring database.