CVE Vulnerability Catalog

An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Affected versions: Spring Security 7.1.0, 7.0.0-7.0.6, 6.5.0-6.5.11, 6.4.0-6.4.18.

Missing Authentication for Critical Function vulnerability in Spring Cloud Config allows unvalidated Webhook requests to the /monitor endpoint. Affects versions from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2.8, and through 3.1.14.

The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Affected versions: Spring Cloud Config 5.0.0-5.0.4, 4.3.0-4.3.4, 4.0.0-4.2.8, 3.1.14 and earlier.

Winter CMS up to and including 1.2.12 did not enforce per-template-type permission checks in the Theme Editor, allowing a backend user with any single CMS permission to act on template types outside their scope. Additionally, the AssetList widget allowed unauthorized file uploads into the active theme's asset directory.

Winter CMS up to and including 1.2.12 is vulnerable to SQL injection in the backend Filter widget via the numberrange scope type when configured with a conditions key, allowing an authenticated backend user to inject arbitrary SQL. Exploitation requires a third-party plugin to have registered such a filter.

Cross-Site Request Forgery (CSRF) vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges via the Unraid authentication cookie's lax same-site policy.

CTFd v3.7.6 was discovered to be vulnerable to a man-in-the-middle attack.

Bird Home Automation GmbH D1101V-F 000140 is vulnerable to incorrect access control in the key derivation process and password validation process.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback _handler POST field, allowing an authenticated backend user to invoke arbitrary controller methods, including protected, private, and action-prefixed ones. While AJAX requests validate that handler names match the on[A-Z][\w+]* pattern, the postback path passed the submitted _handler value straight to the handler dispatcher with no such check, so any controller that exposes a public action or conditionally relaxes its $requiredPermissions check could be reached, bypassing the roles and permissions system. The built-in Users controller was affected because it set $requiredPermissions to null for the myaccount action, letting any authenticated backend user invoke user-management methods such as update_onDelete and update_onManualPasswordReset without holding the backend.manage_users permission. This issue is fixed in version 1.2.13.

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with the backend.manage_editor permission can store custom Markup Styles that are compiled by the LESS parser and rendered without sanitization on every backend page, allowing stored cross-site scripting. This issue is fixed in version 1.2.13.

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.manage_branding permission is compiled by the LESS parser and rendered without sanitization on every backend page, allowing stored cross-site scripting against backend users. This issue is fixed in version 1.2.13.

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the address parameter in the /ajax_table.php API endpoint.

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the sort parameter in the /ajax_table.php API endpoint. This affects many files in includes/html/table.

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can execute arbitrary shell commands through a command injection in the /graph.php API endpoint.

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine returns success immediately when client-authentication is disabled, which is the case in shipped settings. The redirect value is stored with the authorization code, and the login page sends the browser to it with the code, allowing an attacker to capture the code and exchange it for tokens to read the victim's mail.

Midday allows any team member to delete the team. The delete procedure authorizes the caller with a helper that returns true for every membership row regardless of role. Neighboring procedures check the role and refuse non-owners, but deletion lacks this check. Any invitee can remove the team and all scoped records, and the cleanup job uses stored bank-connection tokens against connected providers.

Netmaker disables certificate verification on the connection to the configured mail server. The skip-verify field is set to true unconditionally, allowing the client to accept any certificate, including one from an interposing party. Mail sent by Netmaker includes password-reset messages with single-use tokens and user invitations with enrolment links, which can be intercepted.

Automatisch reveals whether an address is registered through the response to its forgot-password request. The route is mounted without authentication and without rate limiting, allowing account enumeration.

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler resolves the authenticated user from the token but issues the update against a filter built from the URL identifier, without comparing them. The route is behind an administrator token check only, so any admin session suffices. The sole guard rejects a single hardcoded demo address. An attacker can set an arbitrary password on any other admin account and sign in as it.