CVE Vulnerability Catalog

The Graphene plugin versions up to 2.9.4 contain a Subscriber Cross Site Scripting (XSS) vulnerability. A low-privileged user can inject malicious scripts that execute in other users' browsers.

OpenList before version 4.2.3 contains a vulnerability in the offline download feature that allows an unprivileged user to write files outside the temporary directory, potentially creating, truncating, or overwriting any file writable by the OpenList process. The vulnerability stems from a lack of containment check in the filename derived from the Content-Disposition header.

A vulnerability in MISP allows an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. By supplying a pre-encoded string instead of an array structure, an invalid definition can be persistently stored. On retrieval, invalid JSON triggers an exception, causing HTTP 500 errors in event template functionality.

MISP contains a session fixation vulnerability in the CustomAuth authentication flow. After successful authentication via CustomAuth, MISP stores the authenticated user identity in the existing session without first rotating the session identifier. An attacker who knows the victim's session identifier before authentication can later reuse it to access the victim's authenticated session.

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before placing it into a command line for an integrated terminal. An unauthenticated remote user who persuades a developer to accept a connection and open the shell feature can inject arbitrary characters into that command line.

An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name, the library may read memory outside the intended buffer and terminate the calling process.

An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On 32-bit builds, an unauthenticated party able to supply a sufficiently large JSON input to an application may cause it to terminate unexpectedly, resulting in denial of service.

A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be triggered by specially crafted certificate data during the handshake, causing the same heap object to be released twice and leading to unexpected termination of the client application.

An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened or the corresponding field to be omitted, while the parsing operation still reports success and returns no error.

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.

Exterro FTK Imager before 8.3 contains an XML external entity (XXE) injection vulnerability that allows attackers to read arbitrary files from the host filesystem by embedding malicious external entity references and attacker-controlled XSLT stylesheets within a Report.xml file inside a UFDR ZIP evidence item.

A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a GitRepo resource can cause the Fleet controller to disclose cluster metadata and information about hosts reachable from the controller's network position.

pymonocypher uses cython to wrap the Monocypher C library. Prior to version 4.0.2.8, the argon2i_32 implementation does not check the nb_blocks size. If the caller does not provide a sufficiently large buffer based on the API contract, then argon2i_32 will write past the end of the buffer and possibly corrupt the heap.

Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() (bypassing GORM's soft-delete scope) but keeps the read-authorization clause as "owner_id = ? OR is_public = ?". As a result, any unauthenticated caller can enumerate the metadata of soft-deleted ("trashed") notes belonging to any public book — notes the owner explicitly deleted and expected to be removed from public view.

A persistent unsafe URL injection vulnerability was found in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only at render time and not when the configuration was saved, so an authenticated user able to modify widget settings could persist arbitrary URL values, including javascript: scheme URLs. The patch adds a canonical url schema type and validates widget configuration before it is persisted.

MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being serialized as JSON and embedded inside a <script> element.

MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution, sharing group, organization, or other access-control restrictions associated with the correlated attributes and events. As a result, an authenticated user could receive correlation results referring to attributes or events that the user was not authorized to access.

The GET AdminRoleHandler endpoint in Oppia is decorated with open_access, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filter_criterion parameters to retrieve usernames holding specific roles, banned flags, and managed topic identifiers without authorization.

CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allowing authenticated users to modify arbitrary system inbox messages. Attackers can update any message's columns including is_del, look, and uid to delete, mark read, or reassign victim notifications without authorization.

A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. This affects the function ilObjMediaObjectGUI::uploadMultipleSubtitleFileObject of the component MediaPool. The manipulation results in unrestricted upload. The attack may be launched remotely. Upgrading to version 9.22, 10.10 and 11.3 is able to mitigate this issue.