CVE Vulnerability Catalog

Homer prior to version 11.0.283, on every fresh deployment using internal authentication, automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism, allowing any attacker to gain full administrative access.

Homer, open source telecom observability software, before version 11.0.283 is vulnerable to SQL injection in the V4StatisticsQuery handler. The user-supplied rawquery field is passed directly to DuckDB without calling sqlvalidator.ValidateRawSQL, allowing any authenticated user to execute arbitrary SQL statements against all data accessible via the FlightSQL service.

PraisonAI prior to version 4.6.78 has a vulnerability in the `deploy/api.py` module that generates Python server code by directly interpolating the `agents_file` parameter into an f-string, which is then written to a file and executed via `subprocess.Popen()`. An attacker who controls the `agents_file` value can inject arbitrary Python code.

A vulnerability in the web-based management interface of Cisco Finesse is due to improper input validation for specific HTTP requests. An unauthenticated, remote attacker could send a crafted HTTP request to conduct server-side request forgery (SSRF) attacks. A successful exploit could allow the attacker to obtain limited sensitive information for services associated with the affected device.

A vulnerability in the web-based management interface of Cisco License On-Prem (formerly SSM On-Prem) could allow an unauthenticated, remote attacker to gain unauthorized access to the application. It is due to improper checks during the password reset process.

A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to execute arbitrary commands as the root user. The vulnerability is due to insufficient input validation of user-controlled command arguments. Exploitation requires valid administrative credentials.

A vulnerability in Cisco NX-OS Software could allow an unauthenticated, remote attacker to exhaust system resources, causing a denial of service (DoS) condition. The issue exists because rate limiting was improperly applied to some protocols. An attacker could exploit this by sending a high rate of UDP or TCP connections to a data plane interface, leading to instability in routing and control plane protocols.

A vulnerability in the endpoint group (EPG) contract functionality of Cisco Nexus 9000 Series Fabric Switches in ACI Mode could allow an unauthenticated, remote attacker to bypass configured EPG contracts. The issue is due to improper control with EPG contracts. An attacker could exploit this by sending IPv4 or IPv6 packets using UDP source and destination ports assigned to DHCP traffic, allowing bypass of EPG contracts.

A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escape the Python sandbox and gain unauthorized access to the underlying operating system. The issue is due to insufficient validation of user-supplied input. An attacker could manipulate specific functions within the Python interpreter to execute arbitrary commands on the operating system with the privileges of the authenticated user.

The @backstage/plugin-techdocs-node package prior to versions 1.14.6 and 1.15.4 did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify documentation sources may cause a TechDocs build to access resources outside the intended documentation boundary, potentially exposing backend-host data or internal network resources.

A heap-based buffer overflow was found in GIMP's PCX export plug-in. For images with extremely large width and height, buffer allocation uses overflowing 32-bit width * height arithmetic while subsequent GEGL operations use the full extent, after integer overflow in size calculation.

Cisco Jabber for Android (com.cisco.im) before 15.3.1.311364 contains a path traversal vulnerability that allows a malicious app with no permissions to write attacker-controlled files into Jabber's private data directory by exploiting the exported crosslaunch.share activity and an unsanitized display name from a ContentProvider used in file path construction. Attackers can craft a shared content:// URI with a display name containing '../' sequences to place fully attacker-controlled content within directories such as databases/, shared_prefs/, no_backup/, and files/ without user interaction.

A vulnerability of type "Use of Externally-Controlled Input to Select Classes or Code" in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to arbitrary file creation or truncation. Only applications that use jackrabbit-spi2dav (directly or through jackrabbit-jcr2dav) to connect to a remote repository are affected. Jackrabbit servers are not affected. Category: unsafe reflection on wire data (HIGH).

Session Fixation / Session Reuse vulnerability in Apache Jackrabbit. The WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match without credential check. Affects versions from 2.23.0 through 2.23.5, 2.22.0 through 2.22.4, and 2.20.0 through 2.20.17.

Authenticated users are able to manipulate both the SMTP envelope "Envelope-from" and "From" fields when sending emails through OVH mail servers. Due to OVH's default SPF configuration, which commonly includes include:mx.ovh.com, any authenticated user with a valid OVH email account can send messages that appear to originate from any OVH-hosted domains using the default SPF record. Since the SPF policy explicitly authorizes OVH mail servers (mx.ovh.com) to send mail on behalf of these domains, forged messages successfully pass SPF validation despite not being authorized by the impersonated domain owner.

MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance's validation rule rejects the object because the description field is empty. As a result, the receiving instance silently drops the object along with all of its associated attributes, leading to loss of threat-intelligence data. Preconditions: Two or more MISP instances are configured to synchronize objects; a user with object-creation privileges creates an object without supplying a description; the object is subsequently synced to a peer instance. Impact: Valid objects and their attributes are silently discarded on receiving instances, causing data-integrity loss in the threat-intelligence pipeline. The issue is not externally exploitable in a traditional sense but can be triggered by any authorized user who creates objects without descriptions, resulting in unintended data loss across the sync topology. Affected: <2.5.48.

MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store, validated, and then deleted in separate non-atomic steps, allowing a second in-flight request to read the same value before the first request's deletion takes effect. Preconditions: The target MISP instance has email OTP login enabled; the attacker possesses a valid, unexpired OTP (e.g., via email interception or social engineering); the attacker can issue two HTTP POST requests in close temporal proximity. Impact: The one-time-use guarantee of the OTP is violated; a single code can yield two authenticated sessions. This weakens the authentication control and may facilitate unauthorized access if the OTP is shared or intercepted. Affected versions: <2.5.48.

Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service responses and enumerate internal hosts and ports through error messages.

Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view campaign results or send test emails, stealing API keys.

Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can send a different forwarded address per request so the limiter keyed on rewritten RemoteAddr never triggers, enabling unlimited password guessing and credential stuffing.