CVE Vulnerability Catalog

IBM WebSphere Application Server versions 9.0, 8.5, and IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service attack caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

IBM WebSphere Application Server versions 9.0 and 8.5 are vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure.

IBM WebSphere Application Server and Liberty are vulnerable to remote code execution and denial of service in the WebSphere Web Server Plug-in component. This vulnerability can be exploited when an attacker impersonates the application server and sends crafted responses to the plug-in.

IBM WebSphere Application Server versions 9.0 and 8.5 and IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.6 are vulnerable to HTTP request smuggling. A remote attacker could smuggle a specially crafted request to the application server, allowing the attacker to bypass security controls, spoof identity, escalate privilege, and expose sensitive information.

Chainlit before version 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without ownership verification. Attackers can exploit the restore_existing_session path to assume a victim's permissions and roles, enabling unauthorized invocation of tools and access to data restricted to the authenticated victim.

In Angular (@angular/common) prior to versions 22.0.1, 21.2.17, and 20.3.25, a DoS vulnerability exists. The formatDate function and DatePipe do not limit the length of the format parameter, allowing CPU and memory exhaustion via a maliciously long format string.

The Angular Language Service VS Code extension configures the tooltip Markdown renderer with isTrusted: true, allowing active command: URIs. The language server fails to sanitize JSDoc strings, enabling an attacker to inject malicious command links. When a developer hovers over a symbol and clicks the link, the command executes on their host machine.

The Angular Language Service VS Code extension before version 21.2.4 reads the custom TypeScript SDK path from .vscode/settings.json without verifying Workspace Trust. It then passes this path as an argument to the language server process, which dynamically imports the tsserverlibrary.js library from the attacker-specified location. This allows arbitrary code execution when a developer opens a crafted repository.

Incorrect caching of authentication between different users in the qSnapper dbus service before version 1.3.3 allows any local attacker to use dbus functions after a privileged user has authenticated.

In qSnapper before version 1.3.3, incorrect caching of authentication between different polkit methods allowed a local attacker to use functions like 'restore from snapshot' even if only allowed to do 'delete snapshot'.

A path traversal vulnerability in qSnapper before version 1.3.3 allows a local attacker to use malicious snapper config files via the "configName" parameter. This can lead to denial of service or potential privilege escalation to root.

A time-to-check-time-of-use vulnerability in the polkit authentication of qSnapper before version 1.3.3 allowed a local attacker to bypass qSnapper's authentication mechanism and operate with root privileges.

IBM WebSphere Application Server versions 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications.

A vulnerability in the Geomap panel in Grafana allows a user with Editor permissions to inject a malicious script into the attribution field of an XYZ tile layer via a template variable. The script executes in the browser of any user viewing the affected dashboard (stored cross-site scripting).

A path traversal vulnerability exists in AIL Framework before the release containing commit 0041456af25da0cdea1c1c4624e46baff2731d8f. An authenticated AIL user can supply crafted object identifiers through the investigation workflow to access files outside the intended directories.

MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbitrary filesystem path, potentially leading to arbitrary code execution with the privileges of the MISP process.

MISP allows a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Due to the ability to inject PHP code by an attacker with administrator privileges, remote code execution may occur.

The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorization flow that could allow attackers to bypass important security guarantees provided by the protocol. The vulnerability includes session identifier leakage, lack of session rotation after login, weak OAuth state, missing HTTPS enforcement, and log injection.

The MISP core contains multiple access control flaws that allow unauthorized modifications and deletions of data across organizations. Lower-privileged users can manipulate objects they are not authorized to edit.

MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. Users with broad permissions could delete objects belonging to other organizations without proper authorization.