CVE Vulnerability Catalog

Vulnerability in Apache Camel Undertow component causes sensitive information disclosure by returning full stack traces in HTTP responses. The muteException option defaults to false, exposing detailed exceptions on route processing errors. Rest DSL consumers ignore this option entirely, always returning stack traces.

A vulnerability in the Apache Camel Netty HTTP component causes the muteException option to default to false, returning full stack traces in HTTP responses on processing errors. Unauthenticated clients can thus obtain sensitive internal information like credentials, filesystem paths, and dependency versions.

A vulnerability in Apache Camel Salesforce component allows an attacker to inject arbitrary SOQL/SOSL queries, override the target SObject, or redirect Apex REST calls by setting control headers in an HTTP request. This occurs because the headers lack the 'Camel' prefix and are not blocked by HttpHeaderFilterStrategy, allowing them to pass from an HTTP request into the Salesforce producer.

A vulnerability in the Apache Camel Kafka component allows an attacker to override the target Kafka topic via the `kafka.OVERRIDE_TOPIC` header in an HTTP request. Due to improper input validation and neutralization of special elements, in routes bridging an HTTP consumer to a Kafka producer, any HTTP client can redirect messages to arbitrary Kafka topics, including sensitive internal ones. Affected versions: Apache Camel from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.

A vulnerability in the Apache Camel IRC component allows an attacker to inject control headers (e.g., irc.sendTo) via untrusted HTTP input, redirecting IRC messages to an arbitrary channel or user. The issue stems from improper input validation and lack of special element neutralization in headers that bypass the HTTP filter strategy.

A vulnerability in the DAPR component of Apache Camel allows an attacker to redirect messages to arbitrary Dapr Pub/Sub components and topics. This is due to improper validation of the CamelDaprPubSubName and CamelDaprTopic headers, which are copied from inbound CloudEvents and used as producer routing.

A vulnerability in the Apache Camel JIRA component allows an attacker to bypass authorization and input validation via user-controlled HTTP headers. In routes bridging an HTTP consumer to a JIRA producer, an attacker can supply headers like IssueKey or ProjectKey, enabling unauthorized operations on the JIRA instance with the configured service account's privileges.

In Apache Camel's camel-elasticsearch-rest-client component, improper input validation allows an attacker to bypass authorization via user-controlled headers. Unprefixed header names (e.g., SEARCH_QUERY, OPERATION) bypass the HTTP header filter, enabling remote manipulation of Elasticsearch queries without authentication.

A vulnerability in uniFLOW Universal Login Manager (ULM) Standalone allows an authenticated administrator to access sensitive configuration information via the RUI interface. The flaw affects SMTP and LDAP integration settings.

A weakness has been identified in imhamzaazam ecommerceFlask up to commit cb7d9e24c30a99379651b7493b32048126ef402b, in an unknown function, allowing Cross-Site Request Forgery (CSRF). The attack can be initiated remotely, and the exploit has been made public, increasing the risk of exploitation.

A SQL injection vulnerability has been discovered in CodeAstro Ecommerce Website 1.0 in the file /customer/my_account.php?my_wishlist. Manipulation of the delete_wishlist argument allows remote attackers to execute unauthorized database queries. The exploit has been publicly released, increasing the risk of attacks.

A SQL injection vulnerability was found in CodeAstro Apartment Visitor Management System 1.0 in the visitor-entry.php file. Remote attackers can manipulate the visname argument to inject SQL. The exploit is publicly available.

A SQL injection vulnerability was found in CodeAstro Apartment Visitor Management System 1.0 in the file /apartment-visitor/edit-apartment.php. Manipulating the editid argument allows remote attack execution. The exploit has been publicly disclosed and may be used.

A SQL injection vulnerability was found in CodeAstro Apartment Visitor Management System 1.0 in the file /apartment-visitor/report.php. An attacker can remotely manipulate the fromdate argument, leading to SQL injection. The exploit has been made public, increasing the risk of exploitation.

A SQL injection vulnerability has been found in CodeAstro Apartment Visitor Management System 1.0 in the file /apartment-visitor/action-visitor.php. An attacker can remotely manipulate the 'remark' argument to inject SQL code. The exploit has been publicly disclosed, increasing the risk of exploitation.

A flaw in Craft CMS up to version 4.18.0.1 affects the Charts endpoint. The actionGetNewUsersData function in ChartsController.php improperly authorizes access via the userGroupId argument, allowing unauthorized actions. The attack can be carried out remotely.

A vulnerability was found in Craft CMS up to version 4.18.0.1 in the actionReorderSets function of GlobalsController.php. Manipulation of the reorder-sets endpoint leads to authorization bypass.

A security vulnerability was found in Formbricks 5.0.0 in the Survey Handler component (file apps/web/modules/survey/link/actions.ts). Manipulation leads to improper access controls, allowing remote exploitation.

Vulnerability in Mojo::JSON for Perl before version 9.47 causes memory exhaustion due to unbounded recursion in the pure-Perl JSON decoder. A deeply nested JSON document can exhaust process memory.

A vulnerability was found in vxcontrol PentAGI up to version 2.1.0 in the file backend/pkg/docker/client.go of the Docker API component. Manipulation leads to a sandbox issue. The attack can be initiated remotely.