CVE Vulnerability Catalog

Combodo iTop, a web based IT service management tool, prior to version 3.2.3, contains a Reflected Cross-Site Scripting (XSS) vulnerability in the universal search. This issue has been fixed in version 3.2.3.

Combodo iTop, a web based IT service management tool, prior to version 3.2.3, contains a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3.

Combodo iTop, a web based IT service management tool, prior to version 3.2.3, contains a Reflected Cross-Site Scripting (XSS) vulnerability in the synchro import script. This issue has been fixed in version 3.2.3.

Combodo iTop, a web based IT service management tool, prior to version 3.2.3, contains a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3.

Combodo iTop is a web-based IT service management tool. Prior to version 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3.

Joomla extension J2Store (versions 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5) is vulnerable to Stored Cross-Site Scripting (XSS) through the guest checkout billing address fields. An unauthenticated attacker exploits a filter bypass in Joomla's Input::getArray() combined with PHP's variables_order=EGPCS (Cookie overrides POST in $_REQUEST) to store unsanitized HTML in fields such as billing_first_name.

Joomla extension J2Store (versions 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5) allows an unauthenticated visitor to supply any order_id as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals.

Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file() in bundle-uri.c during clone or fetch when transfer.bundleuri=true. Non-HTTP(S) values are treated as local filesystem paths, and file URI prefixes are removed, so a bare UNC path or file URI targeting an attacker-controlled share causes Windows to initiate an outbound SMB connection. This can expose NTLM authentication material to the attacker-selected host. This issue is fixed in version 2.55.0.windows.4.

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when `new URL()` throws a parse error, the `assertSecureUrl` function returned without throwing, silently allowing the request to proceed without HTTPS validation. Starting in version 0.2.136, the catch block now throws an error instead of silently returning.

Combodo iTop is a web-based IT service management tool. Prior to version 3.2.3, unauthenticated users can access uploaded sensitive data via sniffed URL. This issue has been fixed in version 3.2.3.

Combodo iTop is a web-based IT service management tool. Prior to version 3.2.3, iTop has a reflected Cross-Site Scripting (XSS) vulnerability in its dashboard revert functionality with the parameter dashboard_id in /pages/ajax.render.php. This issue has been fixed in version 3.2.3.

Combodo iTop is a web-based IT service management tool. Prior to version 3.2.3, inline images that are accessible without being authenticated are protected by a weak 24-bit pseudo-random secret. This issue has been fixed in version 3.2.3.

Combodo iTop is a web-based IT service management tool. Prior to version 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has been fixed in version 3.2.3.

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenAPIValidationErrors without guarding stack exhaustion. An unauthenticated attacker can send a roughly 10 KB JSON value nested thousands of levels deep to POST /edge/validate, POST /edge/issue-token, or another OpenAPI-validated endpoint, causing RangeError: Maximum call stack size exceeded in openAPIValidationMiddleware and terminating the Node process because no uncaughtException handler recovers it. Replaying the request can sustain a complete service outage. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2.

DiscordChatExporter before version 2.47.2 saves Discord chat logs to a file. HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatMarkdownAsync and FormatEmbedMarkdownAsync without HTML entity encoding. Fields such as message.Content, embed.Title, embed.Description, field.Name, and field.Value can contain a script payload that executes when the exported HTML is opened.

OctoPrint before versions 1.11.8 and 2.0.0rc3 has a parsing discrepancy between its custom Tornado upload handler and Flask/Werkzeug, allowing an attacker with FILE_UPLOAD permission to inject reserved internal upload fields via query parameters or parser differentials. Affected endpoints include /api/files/{local|sdcard}, /api/languages, /plugin/backup/restore, and /plugin/pluginmanager/upload_file.

BabelDOC before version 0.6.3 has a vendored PDF parser in babeldoc/pdfminer/cmapdb.py that deserializes untrusted pickle data when CMapDB._load_data() loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink after path separators are decoded, while _normalize_cmap_name() removes only a leading slash.

FreeRTOS-Kernel before version 11.3.1 lacks minimum size validation in secure context allocation, which might allow local users to corrupt secure-world heap metadata via an out-of-bounds write with an undersized stack size parameter.

FreeRTOS-Kernel before version 11.3.1 lacks privilege verification in the secure context cleanup handler, which might allow local users to cause a use-after-free condition in secure-world memory via the SVC handler for secure context deallocation.

FreeRTOS-Kernel before version 11.3.1 has improper input validation, which might allow an unprivileged task on MPU-enabled ports to execute code in privileged kernel context.