CVE Vulnerability Catalog

Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some EUC_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.

Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.

Kimai is an open-source time tracking application. Prior to 2.58.0, ExportController::createExportTemplate() and ExportController::editExportTemplate() inherit only the class-level create_export permission, which ROLE_TEAMLEAD receives by default, and omit the create_export_template permission required by the API routes and user interface. A teamlead can directly access the export template creation and editing web routes to create or modify global ExportTemplate records marked available to all users, altering export columns, renderer, format, and output used by other users and administrators. This issue is fixed in version 2.58.0.

Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/project/{id}/rate/{rate}, /en/admin/customer/{id}/rate/{rate}, and /en/admin/activity/{id}/rate/{rate} independently resolve the authorized parent identifier and the attacker-selected child rate identifier without confirming that the ProjectRate, CustomerRate, or ActivityRate belongs to that parent. An authenticated user who can edit one parent object can pair it with a rate record from an unauthorized project, customer, or activity and persist changes to billing configuration in kimai2_projects_rates, kimai2_customers_rates, or kimai2_activities_rates. This issue is fixed in version 2.57.0.

Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/{id}/members/{userId} and POST /api/teams/{id}/activities/{activityId} verify that a teamlead may edit the Team but do not verify access_user for the referenced User or view access for the referenced Activity. A teamlead can add users or activities outside the teamlead's manageable scope to an editable team, bypassing the narrower choices enforced by TeamEditForm and UserRepository::getQueryBuilderForFormType(). The resulting relationships can be trusted by RolePermissionManager::checkTeamAccessActivity() and other team-based authorization, visibility, reporting, and workflow logic. This issue is fixed in version 2.58.0.

Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/{id}/stop and GET /api/timesheets/{id}/restart, which reuse an authenticated browser session and perform state-changing operations through GET requests without a request-forgery defense. A remote attacker can cause a logged-in user to request either route from attacker-controlled content, stopping a running timesheet or restarting a historical entry to create and start a new timesheet without the user's consent. The unauthorized changes can corrupt time records, billing, reports, approvals, and audits. This issue is fixed in version 2.58.0.

Kimai is an open-source time tracking application. Prior to 2.58.0, PATCH /api/timesheets/{id}/restart, PATCH /api/timesheets/{id}/duplicate, and the web duplicate workflow can derive a new record from an owned historical timesheet after the user's access to its project or activity has been revoked. TimesheetVoter evaluates the own-timesheet permission before current team access, and its canStart() logic validates object visibility but does not verify the user's current team access to the referenced project and activity. An old entry therefore acts as a persistent capability to create new time records under an unauthorized project and activity, corrupting budgets, statistics, reports, and invoices after an administrative revocation. This issue is fixed in version 2.58.0.

Prior to version 2.57.0 of Kimai, GET or POST requests to /en/admin/activity/create/{project} and /en/admin/project/create/{customer} required only the generic create_activity or create_project capability and did not verify edit access to the supplied Project or Customer object. A user knowing a valid project.id or customer identifier could create a new child business object under an unauthorized parent, polluting project or customer configuration and influencing later time-entry, rate, reporting, and billing behavior.

Prior to version 2.57.0 of Kimai, the PATCH /api/timesheets/{id} and POST /api/timesheets endpoints accepted a user-controlled project identifier that bypassed team access criteria. Any authenticated user with edit_own_timesheet could assign an owned timesheet to a project outside the user's teams, persist unauthorized project attribution, and retrieve project and customer metadata through GET /api/timesheets/{id}?full=true.

Prior to version 2.57.0 of Kimai, the GET /api/timesheets list endpoint accepted user identifiers from a caller with view_other_timesheet but did not verify that a ROLE_TEAMLEAD requester leads a team containing each target user. This allowed a teamlead to retrieve another user's descriptions, timing data, tags, rate, and internalRate even though GET /api/timesheets/{id} would deny access.

Improper handling of insufficient permissions or privileges in Secomea GateManager allows privilege escalation. Affected versions are 11.5;0 and 11.4.625515072:0. Fixed in version 11.6 or 11.4.626194074 and above.

Affected versions of MISP up to 2.5.45 can record incorrect access-log data for requests that terminate in an exception. Because CakeErrorController extends AppController, exception rendering runs the application startup path a second time, causing AccessLog::logRequest() to be called twice for one HTTP request. The second write can overwrite the row created by the first, corrupting request duration, SQL query count, memory usage, and potentially the query log.

Affected versions of MISP up to 2.5.45 expose several state-changing controller actions without restricting them to POST. These actions include purgeUnusedPictures(), enableNoticelist(), removeOrphanedCorrelations(), and rebuildRedis(). An attacker can trigger these actions via ordinary GET requests, using an authenticated victim's session, potentially leading to unauthorized changes.

OpenAM from version 13.0.0 to 16.1.2 has a reflected XSS vulnerability in the OAuth2 authorize endpoint's display=wap consent page. The page reflects request-derived values without HTML escaping, allowing an attacker to execute JavaScript in the OpenAM origin, enabling session or cookie theft, CSRF-token disclosure, and actions with the victim's privileges. At least one registered OAuth2 client is required, but the attacker does not need to control that client.

A vulnerability exists in the Sealed Secrets controller's unauthenticated POST endpoints /v1/verify and /v1/rotate. An attacker with internal network access can inject custom Go template logic into spec.template.data and use differential HTTP response codes (200 vs 409) as a decryption oracle to recover the full plaintext of any sealed secret. The issue is exacerbated by missing AEAD label binding for spec.template.data, allowing arbitrary modification of that field while keeping the ciphertext valid.

OpenAM prior to version 16.1.1 has a vulnerability in the /sessionservice addSessionListener operation that allows an authenticated user to register an arbitrary notification URL without requiring an administrative or application client token. The OpenAM server may make outbound requests to an attacker-controlled destination, potentially disclosing session-related notification data.

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use. This allows an attacker to discover valid usernames within the system.

A vulnerability in MISP involves incorrect filtering of dashboard templates restricted to a specific permission flag. The listTemplates() function allowed a template when the permission flag matched the user's permissions or when the flag was 0. Because the field is a varchar, MySQL performed numeric coercion, causing strings like 'perm_site_admin' to be treated as 0, making restricted templates appear unrestricted.

A stack-based buffer overflow vulnerability in Samsung Opensource rLottie allows attackers to overflow buffers, leading to memory corruption when rendering crafted vector animations. This issue affects rLottie version 480a2ad0c5d2e45458c545b8213279e9e8b71e39.

A vulnerability in MISP arises from relying on CakePHP's request-method override processing, which can disable CSRF and form-security validation. CakePHP honors the _method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the standard verbs (POST, PUT, PATCH, DELETE), CakePHP clears the request body, causing MISP to skip _validatePost() and _validateCsrf(). An attacker can send a form with _method=GET to bypass protections.