CVE Vulnerability Catalog

A path traversal vulnerability was detected in Webpro-nl Knip up to 6.44.0 in the writeFile function of packages/knip/src/IssueFixer.ts in the Workspace Handler component. Manipulation of the workspaces argument leads to path traversal, and the attack can be executed remotely. The exploit has been publicly disclosed and the vendor did not respond.

http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability because DigestEncoder computes the auth-int digest without hashing the request entity body. On-path attackers on non-TLS channels can rewrite the body of authenticated requests while keeping the Authorization header valid, executing state-changing actions as the victim.

http4k before 6.62.0.0-ee contains a path traversal vulnerability in ThymeleafTemplates Caching and HotReload. Unauthenticated attackers can read files outside baseTemplateDir by supplying ../ segments in ViewModel.template() values, as Thymeleaf's FileTemplateResolver resolves escaped paths without containment checks.

A security flaw was discovered in samanhappy MCPHub up to 1.0.45/1.1.7 in src/utils/passthroughHeaders.ts. Manipulation of the passthroughHeaders argument results in information disclosure, and the attack can be launched remotely. Upgrading to version 1.1.8 is recommended.

A vulnerability was determined in jxxghp MoviePilot up to 3.1.2 affecting WorkflowExecutor.restore_context in app/chain/workflow.py. Manipulation can lead to deserialization, and the attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x affecting TradeRefundService.updateAmound in the publiccms-trade component. Manipulation of the refundId argument results in authorization bypass, and the attack can be initiated remotely. The exploit has been made public and could be used.

A vulnerability was detected in WAVLINK WN536AX6-A (version V260507_2.0.0) in the sub_416d48/sub_41a7c0 functions of the /bin/ioos file, within the VPN client list handler component. Manipulation of the opt argument results in missing authentication. The attack can be initiated remotely and the exploit is now public.

Apache Wicket has an incorrect behavior order: a file path is validated by PackageResourceGuard before the framework appends the style, variation and locale attributes. As a result, the file opened may differ from the file approved by the guard, allowing disclosure of HTML markup templates of components whose class names contain an underscore (e.g. Report_v2).

In Apache Wicket, PackageResourceGuard incorrectly allows component markup templates to be served as package resources when wicket-core is loaded by a class loader that cannot see the application's classes. In such a setup the check for a class file beside the template fails, and a request for the package resource URL returns the component's markup template with status 200. Disclosed content is developer-authored template material such as component structure, comments, inline script, and named endpoints.

A security flaw has been discovered in Shanghai Xi Yu Ji Zhi Technology Minimax Code 0.5.8. It affects an unknown part of the Find Command Handler component, where manipulation of the -exec argument results in OS command injection. The attack may be performed remotely.

Apache Wicket fails to enforce resource authorization (isResourceAuthorized() or the @AuthorizeResource annotation) in ResourceLink, Image, ImageButton and AjaxDownloadBehavior components when a resource is passed as an IResource instance. In that case the resource is served without the permission check, while the same control works when a ResourceReference is used. ExportToolbar is also affected because it builds its export links from IResource instances.

Apache Wicket has a missing authorization flaw that allows a component's listener to be invoked even when the authorization strategy denied the RENDER action for it. A crafted or even standard listener URL without a page identifier skips the render phase and Component#configure(), leaving the visibility flag at its constructor default. Components hidden or disabled in Component#onConfigure() are equally exposed.

Apache Wicket versions 10.3.0 through 10.11.0 contain a missing authorization vulnerability in form handling. The form resolves the submitting component from request parameters and passes it directly to onFormSubmitted(), skipping the visibility and enablement check. As a result, a request can invoke actions of a button or link that the application withheld.

Apache Wicket is missing authorization in its native WebSocket support. WebSocketMessageBroadcastHandler calls WebSocketResource#onPayload() directly without consulting IAuthorizationStrategy#isResourceAuthorized(), and the @AuthorizeResource annotation has no effect. A caller only needs a bound Wicket session and the resource name (exposed in the page that opens the connection) to reach all resource callbacks, including onConnect() and onMessage().

A vulnerability was identified in beecue FastBee up to version 2.1.0. An unknown functionality of the /iot/script file in the Groovy Script Executor component allows code injection. The attack can be carried out remotely, and a patch is available under identifier 890a33846005a937a58cccd738b7fb9821b82ea9.

A flaw has been found in ag-ui-protocol ag-ui up to 0.0.58 in the isInterruptExpired function of sdks/typescript/packages/client/src/interrupts/index.ts, within the Interrupt expiry component. The manipulation causes resource consumption. Remote exploitation is possible and the exploit has been published.

A vulnerability was detected in ag-ui-protocol ag-ui up to version 0.0.58 in an unknown functionality of the Transport Decoder Handler component. The manipulation results in improper input validation. The attack may be launched remotely and the exploit is now public.

In the ag-ui library (ag-ui-protocol) up to 0.0.58, the parseSSEStream function in sdks/typescript/packages/client/src/transform/sse.ts (SSE Parser component) allows excessive resource consumption. The attack can be launched remotely and the exploit has been publicly disclosed.

In the ag-ui library (ag-ui-protocol) up to 0.0.58, the e.text function in the HTTP Transport component allows excessive resource consumption. The attack can be launched remotely and the exploit has been made publicly available.

In the ag-ui library (ag-ui-protocol) up to 0.0.58, the file sdks/typescript/packages/client/src/agent/http.ts (HttpAgent component) contains a flaw leading to information disclosure. The attack can be launched remotely and the exploit has been publicly released.