CVE Vulnerability Catalog

matrix-sdk-ui prior to 0.17.0 is missing a check in the message edit validation logic: when replacing an encrypted event, the replacement event itself is not required to be encrypted. This enables malicious homeserver administrators (or actors with equivalent power) to impersonate or spoof messages as if they were sent by a victim user.

The Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 allows inclusion of functionality from an untrusted control sphere. Crafted repository content can modify the workspace settings file, redirecting the Kiro Powers registry request to an attacker-controlled endpoint and sending workspace data when the Powers panel is opened.

Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identified by the dashboard route. A user permitted to add entries to one Express object could create entries in a different Express object outside their authorization scope.

Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type is updated. The Types::submit() dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditPageType(), allowing a signed-in dashboard user to modify Page Types outside their assigned authorization boundary.

Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a link on the site's own domain that sends a user to an arbitrary external site after authentication, facilitating phishing and credential theft. The same handling is present in the registration flow.

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm() endpoint moved selected group tree nodes without validating an action token, so a state-changing group move could be processed for an authenticated user who did not initiate it. Relocating a group under a new parent causes its members to inherit the parent's permissions.

Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The custom_slot save_template endpoint authorizes the request only against the target board instance and then persists the client-supplied selectedTemplateOption[collection] verbatim, allowing a user with permission to edit board contents to store a forged summary object with a JavaScript-bearing HTML payload in the description field. The default summary template renders the description field without output encoding.

A reflected cross-site scripting (XSS) vulnerability in the p.rfihub.com component of Zeta Marketing Platform (ZMP) v1.0 allows attackers to execute arbitrary JavaScript in the victim's browser by injecting a crafted URL into the ca parameter.

Out-of-bounds write vulnerability in Citrix Workspace app for Windows. This issue affects versions before 2603.11 Current Release (CR), before 2507.1 LTSR CU3, and before LTSR 2607.

Out-of-bounds read vulnerability in Citrix Workspace app for Windows. This issue affects versions before 2603.11 Current Release (CR), before 2507.1 LTSR CU3, and before LTSR 2607.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller (concrete/controllers/dialog/event/duplicate.php) submit() action, which duplicated a calendar event after checking only canAccess() and the per-resource canAddCalendarEvent() permission. A crafted cross-site request could cause an authenticated user with add-event permission to create duplicate CalendarEvents and CalendarEventVersions records.

The nl.nl-portal:documenten-api package (through 3.0.0) and nl.nl-portal:besluiten package (1.5.0 through 3.0.0) lack per-user authorization in GraphQL resolvers, allowing an authenticated user to access other users' document contents, decisions, audit trails, and decision attachments. Version 3.0.1 contains a patch.

In versions up to and including 3.0.0, NL Portal Backend Libraries deployments using the shipped default configuration exposed two GraphQL developer features without authentication: the GraphiQL playground and schema introspection. Anyone able to reach the /graphiql endpoint could pull the full schema and use it to map out the API and craft calls against it. Version 3.0.1 patches the issue.

In multipathd, a local attacker with access to the multipathd UNIX control socket can send valid commands and then stop reading replies. This blocks the multipathd listener thread, leading to a Denial of Service (DoS) where legitimate IPC operations may hang or time out. The issue does not result in privilege escalation, arbitrary code execution, or impact data confidentiality or integrity.

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via unvalidated style values. Values submitted through the customizer (color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and ImageStyle) are interpolated into server-compiled LESS source without neutralization of LESS syntax, allowing a user with the Theme Customization permission to inject arbitrary LESS directives. By injecting the @import (inline) directive, an attacker can read arbitrary files on the server and reach internal network resources through PHP stream wrappers, with the compiled output written to the publicly served CSS cache.

The Quiz And Survey Master plugin in versions up to and including 11.2.5 contains an unauthenticated Insecure Direct Object References (IDOR) vulnerability. This allows access to objects that a user should not be authorized to reach.

The Site Kit by Google plugin in versions up to and including 1.186.0 is vulnerable to unauthenticated Cross Site Request Forgery (CSRF). This allows an attacker to force a logged-in user to perform unwanted actions.

The Visual Composer Website Builder plugin in versions up to and including 45.16.1 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This allows injection of malicious script into site content.

The bbPress plugin in versions up to and including 2.6.14 exposes sensitive data to an unauthenticated attacker. This may lead to unauthorized access to information that should remain protected.