CVE Vulnerability Catalog

MISP allows a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Due to the ability to inject PHP code by an attacker with administrator privileges, remote code execution may occur.

The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorization flow that could allow attackers to bypass important security guarantees provided by the protocol. The vulnerability includes session identifier leakage, lack of session rotation after login, weak OAuth state, missing HTTPS enforcement, and log injection.

The MISP core contains multiple access control flaws that allow unauthorized modifications and deletions of data across organizations. Lower-privileged users can manipulate objects they are not authorized to edit.

MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. Users with broad permissions could delete objects belonging to other organizations without proper authorization.

The Windows Machine Config Operator (WMCO) for Red Hat OpenShift establishes SSH connections to Windows worker nodes without verifying the remote server host key. An adjacent-network attacker can intercept or redirect the SSH session to capture WICD and kubelet bootstrap credentials.

A flaw in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform allows the WICD CSR auto-approver to validate the presence of the 'system:wicd-nodes' organization but not reject additional organizations like 'system:masters'. A compromised Windows worker node with WICD credentials can obtain a client certificate with cluster-admin privileges, leading to full cluster takeover.

A vulnerability in the Loki data source plugin allows a user with Viewer permissions to exploit a path traversal to reach administrative Loki endpoints. This enables reading sensitive backend configuration and internal service information.

In ArubaSign, versions prior to v4.6.6 have incorrect default permissions that grant excessive permissions to the 'Everyone' group for the main executable and other program files. This could allow an unprivileged user to replace the main executable with a malicious file.

A vulnerability in GitHub Copilot 1.372.0 allows filesystem access outside the workspace folder without user approval via a file-handler URI parameter in fetch_webpage. This could lead to data exfiltration if combined with indirect prompt injection.

EasyFlow .NET developed by Digiwin has a Session Fixation vulnerability. Unauthenticated remote attackers can replace a specific session ID for a user, allowing them to gain the user's privileges once the user logs in.

SafeLine SL6 and SL6+ devices integrated into elevator emergency intercom systems are vulnerable to an authentication bypass. This vulnerability allows attackers to bypass authentication requirements and access the device's configuration service via the Bluetooth Low Energy (BLE) interface.

A stored cross-site scripting vulnerability in the Runtime component of Pilz PASvisu before version 1.14.1 and PMI v8xx up to and including version 2.0.33992 allows a low-privileged remote unauthenticated attacker to manipulate process data, potentially impacting integrity and/or availability.

A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before version 1.14.1 allows a local unauthenticated attacker to inject malicious JavaScript and gain full control over the device.

Apache NiFi versions 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include components marked as Restricted. This lack of authorization allows users with general write access to add components with restricted access.

Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi versions 1.2.0 through 2.9.0 allows for injecting SQL commands using crafted naming. Manual quoted boundaries added in Apache NiFi 1.8.0 narrowed the scope of potential injection options, but did not cover additional strategies.

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymous attacker if authentication is disabled, to bypass SQL security validation and access metadata outside the intended database scope.

The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints, allowing authenticated users with a custom role to escalate privileges to administrator.

The Transbank Webpay WordPress plugin before version 1.14.0 does not sanitize or escape logs displayed to administrators, allowing unauthenticated users to perform Stored XSS attacks against logged-in administrators.

The ultimate-woocommerce-auction-pro WordPress plugin through version 2.4.5 does not sanitize and escape a parameter before outputting it back on the page, leading to a reflected Cross-Site Scripting vulnerability. This can be exploited against high privilege users such as admins.

An insecure process execution vulnerability exists in the PaperCut Print Deploy Client for Windows. The application, which operates with high-level system privileges, improperly performs an internal validation check by invoking a secondary system utility without specifying a path.