CVE Vulnerability Catalog

Uncaught exception, infinite loop, and integer underflow in Apache Thrift D language bindings. Affects versions before 0.25.0.

All Apache Thrift JS bindings (versions before 0.25.0) are vulnerable to prototype pollution through improperly controlled modification of object prototype attributes. This can lead to unexpected JavaScript application behavior.

Infinite loop and prototype pollution vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol. Affects versions before 0.25.0.

The C++ and D libraries of Apache Thrift contain a certificate validation flaw where, upon a host name mismatch, subjectAltName dNSName entries are checked first and the Common Name is consulted afterwards despite the presence of dNSName entries. A non-matching dNSName yields a "skip" result instead of rejection, allowing a certificate with a matching Common Name to be accepted. This affects the C++ library from 0.7.0 through 0.24.0 and the D library from 0.9.0 through 0.24.0.

Apache Thrift Python bindings (versions before 0.25.0) contain improper certificate validation and return of wrong status code vulnerabilities. This can lead to accepting invalid certificates and communication errors.

Apache Thrift Perl bindings (versions before 0.25.0) contain improper certificate validation and initialization of a resource with an insecure default vulnerabilities. This can lead to establishing insecure connections.

Integer underflow and out-of-bounds write in Apache Thrift C++ 32-bit THeaderTransport. Affects versions before 0.25.0.

Memory allocation with excessive size and resource allocation without limits in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin, and D language bindings. Affects versions before 0.25.0.

Allocation of resources without limits or throttling vulnerability in Apache Thrift Java TSaslNonblockingServer. Affects versions before 0.25.0.

SQL injection vulnerability in the get function of edit_accounts.php in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Manipulation of user_id/patient_id/physician_id/discounts_id/services_id arguments allows remote attack. Exploit is publicly available.

YesWiki before 4.5.3 contains multiple reflected cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure users into opening crafted links to hijack sessions and trigger authenticated requests.

Missing authorization in the attachment download handler in YesWiki before 4.6.7 allows unauthenticated attackers to bypass page read ACLs. They can retrieve confidential attachments from read-restricted pages by knowing the page tag and file parameter.

Unrestricted file upload in YesWiki before 4.6.7 allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. They can import a CSV whose file or image field references a remote .php URL, which is saved without extension checks and executed as server-side code.

YesWiki before 4.6.7 contains a server-side request forgery (SSRF) vulnerability that allows page editors to make the server fetch arbitrary URLs via the url parameter of the Bazar valeur action. Attackers can embed the action with a champ parameter in wiki markup to reach loopback or internal services and partially read responses rendered into the page.

YesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions because login does not regenerate the PHP session ID. Attackers who set or learn a victim's pre-authentication YesWiki-* session cookie can reuse it after login to access private content and perform actions with the victim's privileges.

YesWiki before 4.6.7 contains an insufficient session expiration vulnerability because password reset tokens lack expiry timestamps. An attacker who obtains an unused reset URL from mailboxes, logs, backups, or browser history can submit a new password through checkEmailKey() and take over accounts.

YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/update_config and api/archives to overwrite configuration and list, download, or delete backup archives.

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php. Users who can edit pages or post comments can inject event handlers by placing quotes in markdown image URLs, leading to JavaScript execution in viewers' browsers, including administrators.

YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail handler. An attacker can craft a link whose field value breaks out of the ajax-mail-form action attribute, executing JavaScript in the victim's browser.

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain attacker-controlled outbox first/next links, with fetched responses stored as readable Bazar entries.