CVE Vulnerability Catalog

In the Apache Airflow FAB provider, resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour. The cleanup compares a string session identifier with the user's integer database identifier, so the comparison never matches and no session is removed, leaving an attacker with a copied cookie still authenticated.

In NLnet Labs Unbound up to and including 1.26.0, a vulnerability in the DNSSEC validator enables denial of service and possible remote code execution via DNSKEY processing. A crafted DNSKEY can overflow the digest buffer.

An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The script remains active even after a reboot.

An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly configured.

A privileged attacker can exploit gNSI Certz service on Arista EOS-based products to escalate privileges and execute arbitrary OS commands via a crafted Certz Rotate request. The Bootz service is also affected.

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress in all versions up to and including 1.2.3 is vulnerable to authorization bypass. This is due to the plugin not properly verifying that a user is authorized to perform an action. This allows unauthenticated attackers to modify the email address of arbitrary user accounts, including administrators, which can be leveraged to reset the account password and gain access.

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress in all versions up to and including 3.6.2 is vulnerable to Privilege Escalation. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This allows unauthenticated attackers to create a new administrator-level user account.

Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user. The vulnerability affects the SAML authentication mechanism.

An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker. The vulnerability affects the link processing mechanism.

An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed.

A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framework component of Wärtsilä FOS-Onboard. The key is embedded in the software and cannot be changed by administrators.

A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard. The key is embedded in the software and cannot be changed by administrators.

The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions.

On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source.

`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Prior to version 2.1.27, the SSE transport mode (`SSE=true`) exposes all MCP tools without any authentication. The `upload_markdown` tool reads arbitrary files from the server's local filesystem via an unsanitized `file_path` parameter and uploads them to a GitLab project.

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution.

Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Improper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Use-after-free in DigitalCredentials in Google Chrome prior to 153.0.8010.47. A remote attacker leveraging social engineering could execute arbitrary code outside the sandbox via a crafted HTML page.

Integer overflow in V8 in Google Chrome prior to 153.0.8010.47. A remote attacker can execute arbitrary code inside the sandbox via a crafted HTML page.