CVE Vulnerability Catalog

W FreeIPA odkryto lukę umożliwiającą eskalację uprawnień z hosta do administratora domeny. Problem polega na braku walidacji unikalności krbCanonicalName, co pozwala na wykorzystanie root@REALM jako nazwy administratora realm.

Wtyczka Post By Email dla WordPressa jest podatna na nieautoryzowane przesyłanie plików z powodu braku walidacji typu pliku w funkcji save_attachments we wszystkich wersjach do 1.0.4b włącznie. Umożliwia to nieautoryzowanym atakującym przesyłanie dowolnych plików na serwerze dotkniętej witryny.

Wtyczka Copypress Rest API dla WordPressa jest podatna na zdalne wykonanie kodu poprzez funkcję copyreap_handle_image() w wersjach od 1.1 do 1.2. Wtyczka używa wbudowanego klucza do podpisywania JWT, gdy nie zdefiniowano sekretu, oraz nie ogranicza typów plików, które mogą być pobierane i zapisywane jako załączniki.

Wszystkie wersje pakietu check-branches są podatne na atak typu Command Injection. Narzędzie to, używane lokalnie lub w CI, służy do potwierdzania braku konfliktów w gałęziach git, jednak z powodu zaufania do nazw gałęzi i łączenia ich z wejściem użytkownika, może być narażone na nadużycia.

Crypt::RandomEncryption dla Perla w wersji 0.01 wykorzystuje niebezpieczną funkcję rand() podczas szyfrowania, co może prowadzić do osłabienia bezpieczeństwa danych. Użycie tej funkcji może skutkować przewidywalnymi kluczami szyfrującymi.

go-mail versions 0.7.0 and below incorrectly handle mail.Address values when a sender or recipient address is passed to the MAIL FROM or RCPT TO commands of the SMTP client. This may lead to wrong address routing or even ESMTP parameter smuggling. Exploitation requires that the user's code allows arbitrary mail address input, e.g. through a web form.

FreshRSS versions 1.16.0 through 1.26.3 allow an unprivileged attacker to create an admin user when registration is enabled, by abusing the hidden new_user_is_admin field used only in the admin user management page. This is fixed in version 1.27.0.

FreshRSS versions 1.26.3 and below do not properly terminate the session during logout. After logout, the session cookie remains active and unchanged, which can lead to session hijacking and fixation vulnerabilities. This is fixed in version 1.27.0.

W frameworku ThriveX Blogging w wersjach od 2.5.9 do 3.1.3 odkryto problem w pliku AssistantController.java, który pozwala nieautoryzowanym atakującym na uzyskanie wrażliwych informacji, takich jak klucze API, poprzez punkt końcowy /api/assistant/list.

Vasion Print Virtual Appliance Host prior to 22.0.1049 and Application prior to 20.0.2786 (VA/SaaS deployments) expose PHP scripts under the console_release directory without authentication. An unauthenticated remote attacker can invoke these endpoints to reconfigure networked printers, add or delete RFID badge devices, or modify device settings.

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) contain a default admin account and an installation-time endpoint at /admin/query/update_database.php that can be accessed without authentication. An attacker who can reach the installation web interface can POST arbitrary root_user and root_password values, causing the script to replace the default admin credentials with attacker-controlled ones. The script also contains hard-coded SHA-512 and SHA-1 hashes of the default password, allowing bypass of password-policy validation. As a result, an unauthenticated remote attacker can obtain full administrative control of the system during initial setup.

Vasion Print Virtual Appliance Host prior to 22.0.1049 and Application prior to 20.0.2786 expose four admin routes without authentication, allowing an unauthenticated attacker to upload, delete, or download TLS/SSL certificates and enumerate client IDs via an IDOR.

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 25.2.1518 (VA/SaaS deployments) expose every internal Docker container to the network because firewall rules allow unrestricted traffic to the Docker bridge network. Because no authentication, ACL or client-side identifier is required, an attacker can interact with any internal API, bypassing authentication mechanisms entirely. The result is unauthenticated remote access to internal services, allowing credential theft, configuration manipulation and potential remote code execution.

Vasion Print Virtual Appliance Host prior to 22.0.1049 and Application prior to 20.0.2786 (VA/SaaS deployments) expose internal Docker containers through the gw Docker instance. The /meta endpoint lists all microservice containers with version information, and these containers are reachable without ACL, authentication, or rate-limiting.

Vasion Print Virtual Appliance Host prior to 22.0.1026 and Application prior to 20.0.2702 (VA deployments only) expose unauthenticated REST API endpoints that return configuration files and clear-text passwords and disclose the Laravel APP_KEY used for cryptographic signing. Obtaining the APP_KEY allows an attacker to craft valid signed requests and achieve remote code execution.

Vasion Print Virtual Appliance Host prior to 22.0.1026 and Application prior to 20.0.2702 (VA deployments only) expose an unauthenticated firmware-upload flow. A public page returns a signed token, and every Docker image contains the appliance’s private GPG key and hard-coded passphrase, allowing attackers to decrypt, modify, re-sign, and upload malicious firmware for remote code execution.

Vasion Print Virtual Appliance Host before 22.0.843 and Application before 20.0.1923 have CI/CD weaknesses: the build pulls an unverified third-party image, downloads the VirtualBox Extension Pack over plain HTTP without signature validation, and grants the jenkins account NOPASSWD for mount/umount. This allows supply chain or man-in-the-middle compromise of the build pipeline, malicious firmware injection, and remote code execution as root on the CI host.

Vasion Print Virtual Appliance Host before 22.0.1049 and Application before 20.0.2786 configure the SSH client within Docker instances with UserKnownHostsFile=/dev/null, StrictHostKeyChecking=no, and ForwardAgent yes. These settings disable remote host key verification and automatically forward the developer's SSH-agent to any host matching wildcard patterns, allowing an attacker to capture forwarded private keys and use them for unrestricted lateral movement.

OS command injection vulnerability in the user interface of Western Digital My Cloud firmware (prior to 5.31.108) on NAS platforms allows remote attackers to execute arbitrary system commands via a specially crafted HTTP POST.

Vasion Print Virtual Appliance Host prior to 25.1.102 and Application prior to 25.1.1413 (Windows client deployments) contain a hardcoded private key for the PrinterLogic CA and a hardcoded password in configuration files such as clientsettings.dat and defaults.ini. An attacker obtaining these files can impersonate the CA and perform man-in-the-middle attacks.