CVE Vulnerability Catalog

pac4j-core before version 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger profile type by satisfying generic profile checks.

pac4j-oidc before version 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j role validation.

The cohttp package before version 6.3.0 for OCaml contains a directory traversal vulnerability.

su-exec through version 0.3 fails to properly validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that truncate to root's identifier, causing su-exec to execute target programs with root privileges instead of intended unprivileged accounts.

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts.

BookStack before version 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests.

Skyvern before version 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block output to execute arbitrary code with server process privileges.

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes. This allows unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected BigBlueButton server.

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment. This allows unauthenticated users to have a paid appointment approved for a fraction of its price.

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media items belonging to other users.

The SmartAIPress WordPress plugin through version 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side. This allows users with subscriber-level access and above to make the site retrieve arbitrary internal or external URLs and read the response, resulting in a full-read Server-Side Request Forgery.

The Rest Routes WordPress plugin through version 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL query. This allows unauthenticated attackers to perform SQL injection attacks.

A traffic interception vulnerability in BOSH Director vCenter CPI allows an attacker positioned between BOSH Director and vCenter to impersonate the vCenter REST API and capture administrator credentials transmitted via HTTP Basic auth, leading to complete virtualization infrastructure takeover.

Vulnerability in mapfish-print component (part of MapFish) before versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5. Attacker can control GML layer URL in requests to /api/print3/print, leading to XML parsing without disabling external entities and DTDs. This allows reading files such as OS account data, Kubernetes service-account tokens, and certificates, and enables SSRF.

Vulnerability in Graylog Server before versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder before 7.3. The FortiGate syslog parser mishandles fields inside quoted values, allowing an unauthenticated sender to manipulate security-log fields or evade logging to obscure malicious activity.

Vulnerability in free5GC (5G core network implementation) version 1.4.4 and earlier. The AUSF component stores authentication state in a global map, allowing an attacker with access to the SBI/N12 interface to send concurrent authentication requests for the same SUPI, overwriting the context and denying authentication to the selected subscriber. No fix available.

Vulnerability in Klever-Go (Klever blockchain implementation) before version 1.7.19. A mint-role holder can bypass the finite MaxSupply on semi-fungible tokens via integer overflow, crediting a huge amount and corrupting the on-chain counter. Fixed in version 1.7.19.

Vulnerability in multer (Node.js middleware) before version 2.3.0. A crafted multipart request with two fields can block the event loop, causing denial of service. Version 2.3.0 adds fieldArrayIndexLimit option to reject oversized array indexes.

Vulnerability in IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150. An attacker with physical access can inject Linux loader parameters by writing to an unencrypted and unsigned configuration area, allowing execution of malicious kernel parameters with boot environment privileges without triggering TPM PCR failures.

An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually long run of digits following a LIMIT clause. The issue occurs only on connections where the driver's optional prefetch setting is enabled, and stems from the driver copying the digit sequence into a fixed-size internal buffer without checking its length. A user able to influence the numeric portion of a LIMIT clause could cause the hosting application process to terminate unexpectedly or corrupt adjacent memory in that process.