CVE Vulnerability Catalog

Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) because the frontend calendar lightbox endpoint (/ccm/calendar/view_event/{bID}/{occurrence_id}) does not verify that the caller is permitted to view the calendar that owns the requested event occurrence. The controller loads the occurrence directly from an attacker-supplied, sequential identifier without confirming that it belongs to the calendar configured on the referenced block. An unauthenticated visitor who can render any public calendar block with lightbox properties enabled could therefore supply an arbitrary occurrence identifier and disclose event metadata — title, date, description, page link, and configured event attributes — from calendars they are not permitted to view.

Netskope was notified of an out-of-bounds heap read affecting the Endpoint DLP (EPDLP) service of the Netskope Client. A local standard user could potentially send a specially crafted message that is not properly validated with a bounds check, likely crashing the kernel driver handler. Successful exploitation could potentially crash the EPDLP service, temporarily interrupting DLP enforcement, and could also reveal per-boot memory layout information to unauthorized users.

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbitrary files on the system.

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control.

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-controlled API endpoints.

A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0. An attacker can provide a specially crafted Ruby source file that triggers the parser to pass a NULL pointer to string handling functions, resulting in undefined behavior and application crash.

An issue in ZJU-FAST-Lab EGO-Planner-v2, all versions up to commit 5c99a95880401e2599638d567abc0e240396cb42, allows an attacker to cause a denial of service via EGOReplanFSM::checkCollisionCallback().

Transmute, a file conversion and compression tool, is vulnerable to Server-Side Request Forgery (SSRF) in its URL import endpoint (POST /api/files/url). The downloader fetches user-supplied URLs with redirects enabled and does not validate whether the target resolves to a public address, allowing an authenticated (or guest) user to make the server request internal or cloud-local resources. Since downloaded content is stored and retrievable via GET /api/files/{id}, this is full-read SSRF rather than blind SSRF. Fixed in version 1.3.0.

GoBGP, a BGP implementation in Go, prior to version 4.7.0 accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. A malformed UPDATE that should be rejected as an invalid AS_PATH reaches an unchecked p.Value[0] access, allowing a configured confederation eBGP peer to trigger a denial of service. Version 4.7.0 patches the issue.

GoBGP, a BGP implementation in Go, prior to version 4.6.0 has a BGP OPEN capability parsing issue where several capability decoders may read from the full remaining capability buffer instead of the slice bounded by the declared CapLen. A malformed BGP OPEN message can cause bytes from a following capability to be interpreted as part of the current one; the most security-relevant case is the 4-octet AS capability, where CapLen == 0 may cause the parser to read bytes from the following capability as the 4-octet AS value. This parsed value may later affect peer AS validation during BGP session establishment. Version 4.6.0 patches the issue.

psd-tools, a Python package for working with Adobe Photoshop PSD files, prior to version 1.17.1 allows SmartObject.save() to write an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool extracting embedded objects from an untrusted .psd can be made to write attacker-chosen bytes to an attacker-chosen path (absolute or ../-traversing), outside its intended output directory. A secondary issue in SmartObject.open() for external-kind smart objects allows the attacker-controlled fullPath descriptor to be used as an arbitrary file read path, enabling exfiltration of the read content to the controlled write destination. Both issues are fixed in v1.17.1.

Suricata, a network IDS/IPS and security monitoring engine, prior to versions 7.0.16 and 8.0.5 allows a malicious rule to potentially overwrite any file on the file system on rule load or reload. Versions 7.0.16 and 8.0.5 fix the issue. Workarounds include preprocessing load+save rules to disallow absolute filenames for save, using Suricata's privilege dropping to limit writable files, and/or configuring landlock in suricata.yaml.

FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS). An authenticated administrator can inject arbitrary JavaScript into an item's title, which is stored server-side and executed in the browser of any client user who visits the store page, enabling session hijacking, account takeover, and phishing.

IBM WebSphere Application Server versions 9.0 and 8.5 is vulnerable to server-side request forgery (SSRF) that could allow a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints.

IBM WebSphere Application Server 9.0 and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This could result in information disclosure or denial of service.

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/{flow_id} endpoint, the application allows component inputs to reference storage paths using arbitrary user or flow identifiers without verifying ownership, enabling an attacker with low-privileged authenticated access to supply a crafted file path pointing to another user's storage namespace and read files uploaded by other users.

IBM WebSphere Application Server 9.0 and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this vulnerability to escalate privileges and gain unauthorized access to protected resources.

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user (ROLE_USER) can run the shipped, default-enabled online reports "Maintenance contracts expired" and "Maintenance contracts strategy" via the reporting REST API (POST /rest/reports/{id}) and supply a DATE_FORMAT parameter that the report templates substitute literally, un-escaped, into their SQL queries, allowing arbitrary SQL execution and reading of arbitrary data including database-stored secrets.

A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials.

An authenticated directory traversal vulnerability in file upload functionality has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8. Due to insufficient validation of user-supplied file information, an authenticated remote attacker with access to the affected upload functionality could upload a specially crafted file and cause it to be written outside the intended directory.