CVE Vulnerability Catalog

A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/file-preview-service.ts of the File Preview Service component. Manipulation of the file_path argument leads to path traversal. Local access is required to approach this attack, and the exploit has been disclosed publicly and may be used. Upgrading to version 0.19.52 addresses this issue (patch b7bf78ab74b1552c92fc98c7db9a8a8d92c631df).

Suricata is a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, when Lua rule execution is enabled, the Lua sandbox memory limit was not consistently enforced for new allocations. Certain Lua allocation patterns could exceed security.lua.max-bytes without triggering the intended memory limit, making the configured sandbox limit unreliable. This requires Lua rules to be enabled and an affected Lua script/rule to be loaded.

LIBRID/LIBREF by Ankaref Innovation and Technology Inc. has a stored XSS vulnerability due to improper input neutralization during web page generation. Affects versions from 2.01.0.2183 before 18.9.26.2319.

LIBRID/LIBREF by Ankaref Innovation and Technology Inc. has a stored XSS vulnerability due to improper input neutralization during web page generation. Affects versions from 2.01.0.2183 before 18.9.26.2319.

Observable response discrepancy vulnerability in DernekPlus Website Template allows Account Footprinting. This issue affects Website Template: through 10092026. The vendor was contacted early about this disclosure but did not respond in any way.

cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissive RFC 7230 field-content matcher that allows semicolons, and both are written into the Set-Cookie header unescaped. An application that passes untrusted or request-derived data into the domain or path option can therefore inject additional cookie attributes, overriding SameSite, Secure, HttpOnly, or Domain on the cookies the application issues. This is a Set-Cookie attribute injection issue (CWE-74). The issue is fixed in cookies 0.9.2, which validates domain and path against RFC 6265 character sets. As a workaround, keep domain and path application-set rather than derived from untrusted input.

Some Hikvision intercom products utilize an immutable factory value obtainable from local network or physical interaction, which may allow attackers to forge a legitimate main card and gain permission to issue cards.

Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device Wi-Fi configuration information through these interfaces.

DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component. These credentials can be used to authenticate directly to the ticket system API. This allows an attacker to perform privileged operations beyond what is offered by the application, including reading and modifying tickets.

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source. This action leads to arbitrary JavaScript execution within the mail-viewing context, effectively bypassing the security measures designed to prevent script execution in email content.

A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read with root privileges by the pcsd daemon and can be exfiltrated by the attacker through subsequent cluster node communication. This allows disclosure of sensitive data such as API keys, tokens, or configuration secrets that would otherwise be inaccessible to the attacker.

The Joomla SP Property extension (joomshaper.com) in versions below 4.1.4 contains a path traversal vulnerability in the gallery image management controller. The controller tasks lacked directory confinement checks.

The Joomla T4 Page Builder extension (joomlart.com) in versions below 2.3.0 exposes a front-end JSON editor endpoint with a 'contact' action that requires no authentication, no CSRF token, no captcha (when no captcha plugin is enabled) and has no rate limiting. The attacker fully controls the recipient, subject and HTML body, and mail is sent from the site's configured sender identity.

The Joomla SP Property extension (joomshaper.com) in versions below 4.1.4 relied on client-submitted hidden fields for recipient routing in booking inquiries. This allowed email destination manipulation and form tampering.

The Joomla SP Property extension (joomshaper.com) in versions below 4.1.4 contains missing access control in gallery image management. The controller tasks lacked authorization checks and CSRF token validation, allowing users to invoke file removal actions with arbitrary path strings or upload unverified file types.

The Redux Framework plugin for WordPress in versions up to and including 4.5.13.1 is vulnerable to stored cross-site scripting via the Slider field in User Profile settings. This is due to insufficient input sanitization in the user_meta_save() function and improper output escaping in the Redux_Slider::render() method. An authenticated attacker with Subscriber-level access or above can inject arbitrary scripts into their profile that execute when an Administrator views the attacker's profile page.

The Aruba HiSpeed Cache plugin for WordPress in all versions up to and including 3.0.14 is vulnerable to stored cross-site scripting via the Post Content due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or above can inject arbitrary scripts into pages that execute when a user accesses the injected page.

GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service.

GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.

GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker.