CVE Vulnerability Catalog

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce board creation permissions when importing archive files. An authenticated non-guest team member can create Open or Private boards despite administrator restrictions by importing a crafted .boardarchive file.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate the type of `fields.properties` on block creation. An authenticated user with editor access to a board can crash the Boards plugin worker and trigger a denial of service via a child block whose `fields.properties` is a non-object value.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time. An authenticated user with permission to create posts can cause excessive server CPU consumption and degrade availability for other users via specially crafted post or message attachment content.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly enforce the limit of concurrent files being processed and handled failed files. A user with permission to upload files can spawn more goroutines than intended and block the indexing of other files by constantly uploading heavy files to the server.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads. An unauthenticated attacker can crash the Microsoft Calendar plugin process and deny calendar integration service to all users on the instance via a crafted POST request to the public webhook endpoint.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, and 10.11.x <= 10.11.22 fail to validate channel action ownership. This allows channel managers to update actions in other channels via the channel action update endpoint.

MISP version <= 2.5.45 contains a CSRF vulnerability in UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were added to the unlockedActions list, disabling all CSRF validation (both token and field-hash checks) for those endpoints, allowing an attacker to forge requests that change a logged-in user's settings.

In D-Link DWR-M921 1.1.52, the system function in /boafrm/formDiskPartition mishandles the devicename argument, leading to command injection. The attack can be launched remotely and the exploit has been publicly disclosed.

An Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read, resulting in unauthorized disclosure of information. This issue affects Apache Doris versions 2.0.0 through 2.1.*, 3.0.0 through 3.0.*, 4.0.0 before 4.0.8, and 4.1.0 before 4.1.4.

A vulnerability was detected in an unknown function of /pages/pro_edit1.php in itsourcecode Sales and Inventory System 1.0. Manipulation of the prodcode argument leads to SQL injection, and the attack can be launched remotely. The exploit has been publicly disclosed.

In memcached 1.6.41/1.6.42/1.6.43, the try_read_command_asciiauth function in proto_text.c (mcmc Tokenizer component) allows an out-of-bounds read. The attack can be launched remotely and the exploit has been publicly released. The fix is available in version 1.6.44 (commit af05c9302bba508b736c3da1d5670f63fe8b7db4).

A vulnerability was identified in an unknown part of invoice.php in SourceCodester Inventory Management System 1.0. Manipulation of the ID argument leads to authorization bypass, and the attack can be launched remotely. The exploit is publicly available.

The VSIX publishing service limits the compressed file size (ovsx.publishing.max-content-size, 512 MB by default) but does not limit the decompressed entry size. WebResourceService opens the entry via ZipFile.getInputStream() and copies the decompressed stream without counting bytes, and the java.io.tmpdir cache is evicted by entry count (150), not size, allowing a publisher with their own namespace to fill the temp filesystem.

multer, a Node.js middleware for handling multipart/form-data uploads, in versions 2.2.0 through 2.3.0 does not remove files written after abort cleanup when a disk storage upload is aborted mid-upload. Each aborted upload can leave an orphaned file on disk.

In Tenda W20E 15.11.0.61068_1546_841_CN_TDC, the formIPMacBindAdd function of the HTTP Handler component mishandles the IPMacBindRule argument, leading to a stack-based buffer overflow. The attack can be launched remotely.

Joomla extensions from regularlabs.com — Articles Anywhere < 20.0.0 and Users Anywhere < 2.1.0 (including Pro versions) — return values from request-input data tags without making them safe for the context in which the tag is used. Joomla's string input filter does not make the same value safe for HTML text, an HTML attribute, and a URL simultaneously, enabling reflected XSS.

A vulnerability in Regular Labs Joomla extensions (Advanced Module Manager, Conditional Content, Content Templater, ReReplacer) is an authorization failure in the Conditions editor. The code accepts database table and label-column names from the request and does not restrict them to tables used by supported Regular Labs integrations, allowing an attacker to select a valid but unrelated database field. This is not SQL injection but an access control flaw leading to data disclosure.

The Android application "YAMAP -Social Trekking GPS App" contains an improper access control vulnerability in its WebView implementation. The in-app browser may cause information leakage from the app or redirect users to unintended websites.

SolarView Compact contains a cross-site scripting vulnerability in Image Management. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

SolarView Compact contains a cross-site scripting vulnerability in Schedule Settings and Mail Send Setting. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.