CVE Vulnerability Catalog

Apache NiFi 2.0.0 through 2.10.0 allows creating, reading, and deleting Assets via REST API. The framework authorizes deletion based on the Parameter Context ID without verifying Asset ownership. Installations without different authorization levels across contexts are not affected. Upgrade to 2.11.0 fixes the issue.

Apache NiFi versions 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. An authenticated user authorized to modify a Parameter Context but not authorized on referencing components can alter Parameter values affecting those components. If a Parameter value contains executable scripting content, updating a Parameter can result in code execution during automatic component validation. The issue applies only to deployments using component-level authorization policies. Upgrade to Apache NiFi 2.11.0 is recommended.

go-base, a Go RESTful API Boilerplate with JWT Authentication, has a hardcoded JWT signing secret "random". Any attacker can read this secret from the public repository and forge tokens for any user, including admins, completely bypassing authentication.

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing with low-entropy inputs like timestamp and client IP. This allows an attacker to brute-force the key within a feasible time window.

GL-iNet GL-MT3000 up to version 4.4.5 has a command injection vulnerability in the server.set_peer function of /cgi-bin/glc in the wg-server.so component. Manipulating the public_key argument allows remote command execution.

GL-iNet GL-MT3000 up to version 4.4.5 has a command injection vulnerability in the wg-server.generate_publickey function of /cgi-bin/glc in the wg-server.so component. Manipulating the private_key argument allows remote command execution.

GL-iNet GL-MT3000 up to version 4.4.5 has a command injection vulnerability in the s2s.enable_echo_server function of /cgi-bin/glc in the s2s.so component. Manipulating the port argument allows remote command execution.

GL-iNet GL-MT3000 up to version 4.4.5 has an injection vulnerability in the plugins.set_config function of /cgi-bin/glc in the plugins.so component. Manipulation leads to remote code execution.

GL-iNet GL-MT3000 up to version 4.4.5 has a command injection vulnerability in the plugins.remove_package and plugins.install_package functions of /cgi-bin/glc in the plugins.so component. Manipulation leads to remote command execution.

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware, allowing unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall middleware redirect check. Attackers can supply arbitrary name, email, and password values to the admin-config-setup endpoint, which performs an unauthenticated updateOrInsert targeting the hardcoded administrator user ID, enabling full administrative access to all CRM data.

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component (library/classes/Tree.class.php) that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attackers can chain arbitrary SQL execution to alter the id column type to VARCHAR and insert a malicious PHP payload, which is then executed via an unsanitized eval() call whenever any page instantiates CategoryTree, including unauthenticated and low-privilege pages, resulting in command execution as the web server user.

A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.get_recommend_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Executing a manipulation of the argument Hostname can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

In @fastify/aws-lambda version 6.4.0, the decoration of Fastify requests with request.awsLambda.event and request.awsLambda.context is populated based on client-controlled HTTP headers (x-apigateway-event and x-apigateway-context) instead of the trusted internal token. An unauthenticated attacker can set a single HTTP header and forge the entire Lambda proxy event, including the authorizer context, leading to full authentication and authorization bypass and privilege escalation. Only version 6.4.0 is affected; the fix is in version 6.4.1.

A vulnerability in the XML::Sig library for Perl (versions before 0.71) allows signature wrapping via duplicate ID. The _get_signed_xml() function selects the first node from the XPath result set, enabling an attacker to substitute the content of a signed document.

XPath injection vulnerability in XML::Sig for Perl before version 0.71. The verify() and _get_signed_xml() functions build XPath expressions without proper escaping of the URI value from the document, allowing injection of arbitrary XPath operators.

SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. Because the statement executes on a read-write SQLite handle via a driver that supports stacked (semicolon-separated) statements, an attacker can read and modify database content across all cleartext (non-encrypted) notebooks on the instance.

SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the publish RoleReader token and by anonymous users when publish authentication is disabled. Because the underlying driver executes stacked statements, an attacker can read and modify content across all opened cleartext notebooks (encrypted per-box notebooks are excluded). Fixed in v3.7.3.

SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from PHP_SELF and skips authentication when the value matches 'login_admin.php'. Attackers can append '/login_admin.php' to the path of any target PHP script to cause the authentication check to pass and gain unauthenticated access to all PHP scripts under the manager HTML directory.

A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Performing a manipulation of the argument filename results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.