CVE Vulnerability Catalog

A vulnerability in RabbitMQ topic authorization can allow unauthorized topic writes and binds during metadata-store failures. This occurs because topic-permission lookup errors from Khepri collapse to undefined, which the internal backend treats as allow.

A vulnerability in RabbitMQ before versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6 allows a loopback-restricted user (e.g., guest) to authenticate remotely when traffic is accepted through a trusted PROXY path and the backend listener is loopback-bound. The issue is due to the loopback check using the listener-side socket address instead of the real client source.

An XSS vulnerability in the RabbitMQ management UI allows a user with permission to declare queues or exchanges to execute JavaScript in another user's browser. The issue occurs before version 4.2.5 due to improper escaping of the x-internal-purpose argument in an HTML title attribute.

The rabbitmq_federation_management plugin in RabbitMQ before versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5 does not escape the consumer_tag field on the Federation Status page, allowing XSS attacks. A user with permissions to configure federation upstream or policy can inject JavaScript that executes in the browser of an administrator viewing that page.

A vulnerability in RabbitMQ on Windows prior to versions 4.1.11 and 4.2.6 allows URL-encoded backslashes to be passed to the static file handler before path validation when multiple management extension plugins are enabled. This causes outbound DNS and SMB requests to attacker-controlled UNC paths.

In Grist prior to version 1.7.15, the GET /forms endpoint read table and column metadata without applying the document's access rules and did not check that the requested section was actually a form. A user with only partial read access, including public access on a publicly viewable document, could request the metadata of any widget and reveal table and column structure that access rules would otherwise hide, even in documents that contain no forms.

The Eventin plugin for WordPress (versions 4.0.26 to 4.1.15) has an authorization bypass vulnerability in the payment_complete() function of PaymentController.php. Unauthenticated attackers can mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash, gaining paid event access, QR-code tickets, and confirmation emails without any payment.

In FreeRDP server implementations with the MS-RDPECAM camera device enumerator channel enabled, a malicious RDP client can trigger a 1- to 2-byte out-of-bounds heap read. The vulnerability exists in the function processing DeviceName and VirtualChannelName fields prior to version 3.28.0.

In Snipe-IT prior to version 8.6.2, the unaccepted-assets report delete endpoint authorizes only reports.view and deletes CheckoutAcceptance::pending()->find($acceptanceId) by global ID without checking access to the related checkoutable asset. This allows a reports user in one company to delete pending checkout acceptance records for another company.

In Snipe-IT prior to version 8.6.2, the default.blade.php renders header_color and related branding color settings inside a CSS style block with insufficient HTML escaping for the CSS context. This allows a superadmin to inject arbitrary CSS that affects authenticated users on subsequent page loads when Content Security Policy is disabled.

In Snipe-IT prior to version 8.6.2, a vulnerability exists in the legacy single-seat license checkin flow. The endpoint authorizes the action using the checkout permission instead of the checkin permission, allowing a user with license assignment rights but without unassignment rights to directly reclaim a license seat assigned to another user or asset.

In Snipe-IT prior to version 8.6.1, the Importer API endpoint allows a user with CSV import capabilities and a valid API key to overwrite the created_by value of an import file, enabling unauthorized modification of import ownership metadata.

In Snipe-IT prior to version 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset image field through CSV import and then trigger image deletion, allowing deletion of arbitrary files accessible to the server process.

In Snipe-IT prior to version 8.6.2, the UsersController::show() and printInventory() methods only authorize user viewing before loading and rendering assigned license, accessory, and consumable relationships. This allows an authenticated user with only users.view permission to see inventory and cost/order metadata from modules that direct permissions would otherwise deny.

A vulnerability in Snipe-IT prior to version 8.6.2 allows an attacker to control the redirect after a user edit action. By setting the Referer header, the attacker can force the application to redirect the victim to an external, malicious site.

Logto prior to version 1.41.0 has a vulnerability in TOTP verification that allows reusing the same TOTP code within the RFC 6238 acceptance window. An attacker who knows the first authentication factor and captures a live TOTP code can replay it to bypass MFA.

A vulnerability in Logto prior to 1.41.0 allows script injection (XSS) by reflecting unsanitized SAML RelayState, SAMLResponse, or actionUrl parameters into an HTML form. An attacker can craft a malicious SAML request to execute arbitrary JavaScript in the Logto tenant origin after user login.

The WordPress Infinite Scroll – Ajax Load More plugin up to version 7.0.1 is vulnerable to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. Authenticated attackers with administrator-level permissions can inject arbitrary web scripts that execute when users access affected pages.

The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field values directly into SQL queries during CSV import, without parameterization or escaping, resulting in authenticated SQL injection. An authenticated user with access to the Data injection feature can embed SQL expressions such as SLEEP() in a mapped field (for example Serial Number) to manipulate the generated query and extract database information via time-based blind injection.

In Snipe-IT prior to version 8.6.0, the UsersController::update() method processes a missing permission request field through NormalizePermissionsPayloadAction and PreserveUnauthorizedPrivilegedPermissionsAction in a way that can overwrite a target user's permissions with a sparse result. This allows an administrator updating another administrator, or a user with users.edit updating a regular account, to remove the target's administrative or granular permissions.