CVE Vulnerability Catalog

Checkmate from version 3.3.0 until 3.9.2, when the global showURL setting is enabled, causes the unauthenticated GET /api/v1/status-page/:url endpoint to return complete monitor objects, including the secret field used as an HTTP Authorization credential, even though it is not displayed in the UI.

Omnigent before version 0.3.0 allows an authenticated user to upload a session-scoped agent bundle with an absolute or traversal-containing os_env.cwd value because the parser stores the value verbatim and the validator does not constrain it. When OMNIGENT_RUNNER_WORKSPACE is unset, an attacker can control the path and gain access to runner files and environment secrets outside the intended workspace.

Omnigent before version 0.3.0 has a shared shell-command parser that fails to recognize combined interpreter flags, timeout, nice, setsid, and stdbuf wrappers, command substitutions, and a single background control operator. Commands hidden with these forms produce no parsed operation, causing allowlist and workspace confinement policies to abstain and allow the command.

Omnigent before version 0.3.0 accepts an agent bundle in multipart POST /v1/sessions, and the validator does not reject a dotted Python path in tools..callable. The dispatcher imports the specified module and invokes the function, allowing a bundle to select subprocess.check_output and execute a local command with the runner process permissions.

Checkmate before version 3.9.1 has a memory exhaustion vulnerability in the public registration endpoint. An unauthenticated attacker can send multiple concurrent oversized files that are buffered before validation, leading to memory exhaustion and backend crash.

UAC before version 3.3.0 has a command injection vulnerability in the user substitution logic in parse_artifact.sh. Usernames and home directories from /etc/passwd are substituted into command strings without proper escaping before execution via eval, allowing injection of shell metacharacters.

UAC before version 3.3.0 has a command injection vulnerability in the _command_collector function, where foreach command output lines are substituted into command strings via sed without proper escaping before being evaluated with eval. Attackers can exploit malicious filenames or artifact definitions.

UAC before version 3.3.0 has a command injection vulnerability in the _run_command function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames.

TP-Link TL-MR6400 v7 router has a stack-based out-of-bounds write vulnerability in the login request handling of the administrative web interface. An unauthenticated adjacent attacker can send a specially crafted malformed HTTP request, causing the web service process to crash.

TP-Link TL-MR6400 v7 router has a NULL pointer dereference vulnerability in the HTTP request parsing functionality. An unauthenticated remote attacker can send a specially crafted HTTP request with a malformed session cookie header, causing the HTTP service process to crash.

TP-Link TL-MR6400 v7 router has a stack-based buffer overflow vulnerability in the firmware update functionality due to unsafe processing of attacker-controlled metadata within a firmware image. An authenticated attacker can exploit this to trigger memory corruption and execute arbitrary code.

In the Linux kernel, the route4 classifier (net/sched: cls_route) has a use-after-free bug in its fastmap cache. The classifier stores raw filter pointers in a 16-slot cache, and a race between read and write operations can lead to use of freed memory, potentially causing system crashes or privilege escalation.

In the Linux kernel, the packet_snd() function (packet send path) has an inconsistency in reading dev->hard_header_len, which can lead to an out-of-bounds write during skb construction. The issue also affects packet_sendmsg_spkt().

A vulnerability was found in the Linux kernel's vhost subsystem. The vring metadata cache (vq->meta_iotlb[]) is not reset when the vring is reconfigured via VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM while a device IOTLB is attached. This can lead to stale mappings being used, resulting in memory access outside the actually mapped region.

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain.

Jet Admin allows an attacker to create a malicious app, connect it to a target user's custom domain, edit authentication configuration, and reroute traffic to the attacker-controlled app. If the victim uses an OAuth provider, the attacker obtains the victim's OAuth Client ID and Client Secret.

mod_auth_openidc before version 2.4.19.4 contains an out-of-bounds read and a one-byte out-of-bounds write in the state-cookie parser. The issue is fixed in version 2.4.19.4.

ONNX before version 1.21.0 contains a vulnerability in the 'save_external_data' function that builds the external-data file path and opens it for writing without O_NOFOLLOW/O_EXCL, after a non-atomic 'os.path.isfile()' check. A local attacker can pre-plant a symlink, causing the victim's write to append to any file the victim can write.

OpenViking before version 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint.

to_abs_path in scripts/iib/tool.py normalizes the path with os.path.normpath, which does not resolve symbolic links. A symlink placed inside a scanned directory can point outside that directory, and FileResponse follows the link, disclosing files such as /etc/passwd.