CVE Vulnerability Catalog

A path traversal vulnerability was found in halo-dev halo up to version 2.24.2 in the Download function of the Files Backup Endpoint component. The attack can be performed remotely and the exploit is publicly available.

A security vulnerability has been detected in Sipeed PicoClaw up to version 0.2.9, affecting the NewContextBuilder function in pkg/agent/context.go. The flaw allows inclusion of functionality from an untrusted control sphere, potentially leading to unauthorized actions. The attack requires local access, and the exploit has been publicly disclosed.

A security flaw in Sipeed PicoClaw up to version 0.2.9 allows authentication bypass via capture-replay attack in the LINE Webhook component. The vulnerability affects the webhook.ParseRequest function in pkg/channels/line/line.go. Remote exploitation is possible, and a public exploit increases the risk.

Sipeed PicoClaw up to version 0.2.9 has a time-of-check time-of-use (TOCTOU) vulnerability in the ExecTool.executeRun function. A local attacker can exploit this to compromise data integrity.

A cross-site request forgery (CSRF) vulnerability was found in Sipeed PicoClaw up to version 0.2.9 in an unknown function of the file web/backend/api/auth.go. The attack can be launched remotely and the exploit has been publicly disclosed.

A vulnerability was found in AstrBot up to version 4.25.5 in the _normalize_rw_path function of the fs.py file in the Filesystem Computer-Use Tool component. The flaw allows link following with local access. The exploit is public and the vendor did not respond.

A vulnerability in AstrBot up to version 4.25.5 affects the OpenApiRoute.chat_send function in open_api.py. Manipulating the Username argument in the API allows authentication bypass via spoofing. The attack can be launched remotely and exploit details are publicly available.

The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to 2.2.0. Missing nonce validation on the storeInfo function allows unauthenticated attackers to modify Zoho CRM integration settings via a forged request if they trick an admin into clicking a link.

A flaw in AstrBot up to version 4.25.5 affects the OpenApiRoute.get_chat_sessions function in astrbot/dashboard/routes/open_api.py. Manipulation of the Username argument in the session-listing endpoint leads to authorization bypass. The attack is remotely exploitable and a public exploit exists.

A vulnerability in Microsoft Edge (Chromium-based) allows authentication bypass via an alternate path or channel. An unauthorized attacker can perform tampering over a network.

@hapi/inert versions 4.0.0 to 7.1.0 have a vulnerability due to improper path comparison in the confine mechanism, allowing an unauthenticated remote attacker to read files from sibling directories, e.g., via /..%2fstatic-secret/secret.txt.

The @hapi/wreck HTTP client before version 18.1.2 has a vulnerability in origin comparison during cross-origin redirects. Credential headers (Authorization, Cookie, Proxy-Authorization) are forwarded across same-host port changes and HTTPS-to-HTTP downgrades, allowing attackers to capture tokens and sessions.

@hapi/wreck prior to 18.1.1, when following a 3xx redirect to a different host, strips only Authorization and Cookie headers but leaves the Proxy-Authorization header. This can expose proxy credentials to an external host if redirects are enabled.

Vulnerability in view_component (Ruby on Rails) versions 4.0.0-4.12.0 causes ViewComponent::Base instances to retain render-scoped objects across render_in calls. Reusing a component across requests, users, or threads can lead to stale data usage, potentially resulting in privilege escalation, link leakage, or request context mixing.

The websocket-driver library prior to 0.7.5, when used with the permessage-deflate extension, checks the message size limit against compressed data, not after decompression. This allows accepting messages larger than the configured maximum.

Statamic CMS prior to versions 5.73.24 and 6.20.1 does not neutralize spreadsheet formula characters in CSV export. Form submission values starting with characters like =, +, -, or @ can be interpreted as live formulas when the file is opened in a spreadsheet application. The attack can be carried out by an unauthenticated front-end user and then triggered by an editor opening the export.

Statamic before versions 5.73.24 and 6.20.1 contains a server-side request forgery (SSRF) vulnerability in the Glide image proxy. URL validation in `RemoteUrlValidator.php` and `GuzzleAdapter.php` can be bypassed via DNS rebinding. The hostname is first validated as publicly routable, but when the image is fetched, DNS is resolved again, allowing an attacker to rebind to an internal address after validation and make requests to internal resources, including loopback, private network, and cloud metadata endpoints.

Vulnerability in secure_headers before version 7.3.0 allows CSP directive injection via unsanitized input in override_content_security_policy_directives and append APIs for :sandbox, :plugin_types, and :report_to. An attacker can inject a directive such as script-src 'unsafe-inline' * before the legitimate script-src, enabling XSS or CSP report exfiltration.

Vulnerability in tarteaucitron.js before version 1.33.0. The tarteaucitron.cookie.purge() function is called on any element with the purgeBtn class without checking if it is a legitimate tarteaucitron button. An attacker can delete a non-HttpOnly cookie with a known name via user click.

OpenMcdf library version 3.1.3 and earlier has a loop without cycle detection in DirectoryTree.TryGetDirectoryEntry. A crafted CFB file with cyclic Left/Right sibling links can cause an infinite loop, leading to an unrecoverable denial of service (DoS). The bug is reachable from RootStorage.OpenStorage, TryOpenStorage, OpenStream, and TryOpenStream methods.