CVE Vulnerability Catalog

Dell PowerProtect One, versions 20.1.0.0 and below, contain a Reliance on Insufficiently Trustworthy Component vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Cache poisoning.

Frappe is a full-stack web application framework. Prior to version 15.115.0, an access control bypass in the REST API allows a user to read data from Linked DocTypes they are not authorized to access. When a document references another via a Link field, the framework does not consistently enforce the linked DocType's permissions, so a low-privileged user can obtain fields from linked records outside their scope. Fixed in 15.115.0.

The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon Name and Mail Address to be embedded. The values cannot be changed later, and the generation page reflects them back. The profile is not usable without additional info and only allows the attacker to attack their own device, but HCL Traveler could at least check that the values are found in the Domino directory entry for the authenticated user.

Fleet is an open-source device management platform. In versions prior to 4.86.2, the Okta conditional access integration in Fleet Premium is vulnerable to SQL injection through a host-supplied value used in a database query without proper parameterization, allowing an attacker controlling one enrolled host to read or modify arbitrary data in the Fleet database. By disclosing arbitrary database contents, an attacker can extract stored session tokens and replay them to act as a global administrator, and on a managed fleet that administrator access enables running scripts on enrolled hosts, leading to remote code execution.

Dell PowerProtect Cyber Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects. Affected versions: Reactor Netty 1.3.0 - 1.3.6, 1.1.0 - 1.2.18, and 1.0.52 and earlier.

In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. This requires Brave Tracing to be configured. Affected versions are 1.3.0-1.3.6, 1.1.0-1.2.18, and 1.0.52 and earlier.

Reactor Netty in specific scenarios involving multiple clients with different DNS resolver configurations may incorrectly reuse a previously configured DNS resolver. Affects versions 1.3.0-1.3.6, 1.1.0-1.2.18, and 1.0.52 and earlier.

Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector. Affected versions include Spring Security 5.7.0 through 7.1.0.

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Affected versions are 3.0.0 through 4.1.0.

Fleet up to version 4.84.1 contains a vulnerability in the Apple MDM commands listing endpoint (GET /api/v1/fleet/mdm/apple/commands) that allows an authenticated user with the Observer role to extract sensitive values such as host enrollment secrets and APNs tokens via a sort-order oracle. An attacker can manipulate the order_key parameter and use binary search to reconstruct values character by character. Fixed in version 4.84.2.

Fleet up to version 4.84.1 contains a vulnerability in the labels host-listing endpoint (GET /api/v1/fleet/labels/{id}/hosts) that allows an authenticated user with the Observer role to extract host enrollment secrets via a sort-order oracle. An attacker can manipulate the order_key parameter and reconstruct node_key or orbit_node_key, enabling host impersonation. Fixed in version 4.84.2.

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Through 1.5.0, the validity store uses a strict lower-bound comparison that expires a stored transaction too early relative to Transaction::is_valid_at, allowing a remote attacker to replay the same signed transaction during a blocks_per_batch minus one block window and cause the sender and recipient balances to be updated twice. This issue is fixed in version 1.5.1.

In Stomper 5e2741e, when a client sends a SEND frame missing the destination header field, the server triggers a null pointer dereference (or access to invalid memory) while processing the frame, causing the process to crash.

Stomper 5e2741e is vulnerable to Use-After-Free. When a client sends multiple CONNECT frames on the same TCP connection, and subsequently another client (or a later connection) sends SEND frames to a destination previously subscribed on that connection, the broker may dereference a pointer to a StompStreamSocket object that has already been freed. This results in a heap use-after-free and process crash. Because the protocol does not authenticate or restrict such sequences by default.

Stomper 5e2741e is vulnerable to Use-After-Free. When a single client repeatedly issues SUBSCRIBE commands for the same destination over one connection and then closes that connection, the broker performs incorrect cleanup of its internal subscription structures. This results in a heap use-after-free during StompClient destruction, causing the broker process to crash. An unauthenticated client can exploit this to reliably trigger a denial of service.

Stomper 5e2741e is vulnerable to Denial of Service. When a broker sends data to a client whose TCP connection was already closed by the peer, the server process receives SIGPIPE and immediately terminates, resulting in a denial of service. Any unauthenticated client can trigger the crash by closing the socket at specific points.

stomper 5e2741e is vulnerable to Denial of Service. A malicious client can send partial STOMP frames and keep the TCP connections open, which, combined with the broker's use of edge-triggered epoll (EPOLLET) and MSG_PEEK in recv(), causes sockets to enter a permanent half-read state. When enough such connections accumulate, the broker stops receiving any further epoll events for those sockets and eventually hangs in epoll_wait, effectively refusing to process new messages.

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows unauthorized impersonation of system messages and modification of trusted system-owned data, resulting in vertical privilege escalation and potential integrity violations.