CVE Vulnerability Catalog

Malicious HTML content could be injected into the help texts of various fields with organizer permissions.

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are referred to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but it renders the added protection mechanism useless.

If an attacker is able to convince a victim to click a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, it might lead to their order details being stored into the attacker's account. The attack only works when the event is available on a different domain than the organizer page.

A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information, including the number of attendees and the total revenue.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Initialization of a Resource with an Insecure Default vulnerability. A high privileged attacker with remote access could exploit this to achieve elevation of privileges, information tampering, protection mechanism bypass, and unauthorized access.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Active Debug Code vulnerability. A high privileged attacker with local access could exploit this to cause information disclosure, information tampering, protection mechanism bypass, and unauthorized access.

A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping entire check-in steps.

A vulnerability in GitLab CE/EE allows an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper authorization enforcement in the GraphQL API.

A vulnerability was determined in CodeCanyon Rocket LMS up to 2.2. This affects an unknown function of the component Student Profile Image Upload. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. The impacted element is an unknown function of the file frontend/update-account.php of the component Edit Profile Feature. Performing a manipulation of the argument Name/Address/City results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

The pbkdf2 library through version 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback. Long passwords can block the event loop because the cost is proportional to iterations times password length. Affected are Node.js before 0.12, Bun (1.0.0-1.1.34 and 1.2.6+), Deno 2.9.0+, and direct imports of lib/sync.js.

A vulnerability was found in Netcore NAP930 0.1.241010.141410 in the file /lib/functions/backup_common.sh of the Backup/Restore component. Manipulation of the aes_pass argument causes use of a hard-coded cryptographic key. The attack can be initiated remotely, and the exploit is publicly disclosed.

mall4j through version 4.0 has a missing authentication vulnerability in the DeliveryController checkDelivery endpoint, allowing unauthenticated attackers to read shipment tracking information by supplying an order number. Attackers can access carrier names, waybill numbers, and complete logistics trails for any order without authentication or ownership verification.

A vulnerability was identified in Intelbras TIP 125i 4.3.35/4.3.41 in an unknown function of the Básico Page component. Manipulation leads to inclusion of sensitive information in source code. The attack can be launched remotely, but has high complexity and is difficult to exploit. The exploit is publicly available.

Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus Service (.service) files, instead of validating against an allowlist. A malicious Flatpak app can use this to cause denial of service (e.g. forced application restart loops) or to influence host D-Bus/systemd activation behavior beyond what the sandbox is intended to permit.

Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation failures (denial of service); tampered content would fail signature/digest verification rather than being trusted.

Flatpak writes the OCI repository authentication token with world-readable permissions (0644) in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources (e.g. as used by Fedora) are affected; libostree-based sources such as Flathub are not.

In the CoAP subsystem (subsys/net/lib/coap/coap_link_format.c), the match_path_uri() function compares a registered resource path against the URI in the Uri-Query href option. The URI is not NUL-terminated, and the inner loop advances index k without checking it against the option length len, causing an out-of-bounds read when the resource path is longer than the URI and the URI is a prefix. The vulnerability is reachable via an unauthenticated GET /.well-known/core?href=/<prefix> request to a device with CONFIG_COAP_SERVER_WELL_KNOWN_CORE enabled (default y) and at least one resource with struct coap_core_metadata attributes.

In Laravel prior to versions 12.69.0 and 13.30.0, exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML=true, enabling DOM-based cross-site scripting when a user hovers over the tooltip.

In @grpc/grpc-js prior to versions 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. This causes sensitive information disclosure when the message contains sensitive data.