CVE Vulnerability Catalog

A denial of service vulnerability in GitHub Enterprise Server allowed an authenticated user to disrupt the instance by supplying a deeply nested YAML release notes configuration file. During release notes generation, the file was parsed without a nesting depth limit, causing excessive resource consumption and rendering the instance unresponsive.

Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users with limited privileges to obtain hashed passwords via the cloudinit/dump API.

A cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) 9.x 5.1.8 and 8.x 4.3.16 allows attackers to inject malicious scripts or HTML. The flaw exists in input handling, enabling arbitrary code execution in the victim's browser.

In the keycloak-services component of Red Hat Build of Keycloak, OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. An attacker who intercepts a code can modify it and redeem it with their own client, obtaining access tokens for the victim's identity.

A security flaw in mosaxiv clawlet up to version 0.2.10 affects the list/remove function in tools/tool_cron.go of the cron Chat Tool component. Missing authorization allows remote manipulation. The exploit is public, and the GitHub issue was closed as 'not planned'.

Missing integrity check support in ABB KNX Update Tool (ABB and BJE versions up to 2.0.175) allows an attacker to modify updates undetected.

A flaw in the organization management component of Keycloak allows a delegated administrator with permission to manage organizations to create an invitation for a non-existent email address and retrieve the secret registration link via the API. Using this link, the administrator can create new user accounts and add them to the organization without the required user management permissions or access to the invited email account. This allows bypassing security boundaries and adding unauthorized members.

A vulnerability was found in poco-ai poco-claw up to version 0.5.4, affecting the create_task function in executor_manager/app/api/v1/tasks.py, leading to missing authentication. The exploit has been publicly disclosed and may be used by attackers.

The vulnerability in HCL Aftermarket EPC is due to the HTTP OPTIONS method being enabled on the web server. This method discloses a list of supported HTTP methods, allowing an attacker to narrow down and intensify their attacks.

The vulnerability in HCL Aftermarket EPC is due to a misconfigured CORS policy that allows access from any domain (wildcard '*'). This enables attackers to perform cross-origin requests from external sites.

The vulnerability in HCL Aftermarket EPC is due to the lack of validation of the HOST header in HTTP requests, allowing arbitrary hosts to be accepted. This can lead to Host header poisoning and server misconfigurations.

The vulnerability in HCL Aftermarket EPC involves returning detailed error messages that leak information about server-side processing. An attacker can use this information to launch a more targeted attack.

A vulnerability in HCL Aftermarket EPC allows an attacker to use brute-force techniques to guess or confirm valid users in the system. This attack can lead to confidentiality breaches by identifying user accounts.

The vulnerability in HCL Aftermarket EPC is due to a session token being stored in a cookie, increasing the attack risk. The cookie's content should be reviewed to determine its function.

The vulnerability in HCL Aftermarket EPC is caused by the lack of an appropriate caching policy, allowing sensitive data to be stored in the local cache. Other users with access to the same computer may later retrieve this data.

HCL Aftermarket EPC is affected by a clickjacking vulnerability (Cross-Frame Scripting), allowing an attacker to load the vulnerable application in an iFrame on a malicious site. The attacker can then launch a clickjacking attack, potentially leading to phishing, Cross-Site Request Forgery (CSRF), sensitive information leakage, and more.

Missing X-XSS-Protection header in HCL Aftermarket EPC server allows potential Cross-Site Scripting (XSS) attacks. This vulnerability stems from improper HTTP security configuration.

The vulnerability in HCL Aftermarket EPC exposes the web server software version, allowing an attacker to identify potential security flaws, especially if an outdated version with known vulnerabilities is in use.

A vulnerability in HCL Aftermarket EPC allows sensitive information to be passed via GET method parameters in URLs. This data can be exposed through storage in server logs, browser history, or proxy logs.

HCL Aftermarket EPC is vulnerable to brute force attacks due to missing CAPTCHA implementation. This allows automated login attempts and user account enumeration.