CVE Vulnerability Catalog

A vulnerability in Apache Storm allows a topology submitter to delete blobs belonging to other topologies by listing their keys in `dependency_jars` and `dependency_artifacts`. Additionally, missing validation can cause Nimbus to fail to retain leadership, rendering the cluster inoperative.

The DRPC server in Apache Storm keeps a map from function names to request queues, and entries are never removed. An attacker can send arbitrary function names without authentication (as `drpc.authorizer` is disabled by default), leading to unbounded memory growth and eventual heap exhaustion.

An incorrect authorization vulnerability in Apache Syncope affects the Reconciliation service (pull and push). Due to incomplete delegated administration security checks, calls by administrators lacking proper entitlements may be accepted, enabling unauthorized actions.

Froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Malicious URLs containing literal newlines are written verbatim into vhost config files during cron rebuild, enabling web server configuration corruption, denial of service, or hijacking of HTTP responses across hosted domains.

An incorrect privilege assignment vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can obtain admin privileges after completing successful authentication and obtaining a valid low-privileges JWT.

In Eclipse Embedded CDT versions 6.0 to 6.7, extracting a compromised CMSIS-Pack archive can write files to locations outside the pack directory. This allows arbitrary files to be written to other locations on disk (path traversal / Zip Slip).

Apache Syncope has an incorrect authorization vulnerability. An administrator with ClientApp's update entitlement is unable to perform the related operation, while ClientApp's create entitlement is checked both for create and update operations on ClientApp.

Apache Syncope has an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized entityKey and opEvent parameters.

Apache Syncope has a missing authorization vulnerability. An administrator with task execution entitlements might be able to mass (de)provision group members, regardless of their group-related administration capabilities.

Apache Syncope has an incorrect authorization vulnerability. An administrator with adequate entitlements in a given Realm may be able to read via REST the full Connector configuration, confidential properties included, scoped in another Realm and thus be able to effectively duplicate such Connector instance into the Realm they have administration rights for.

Apache Syncope has an incorrect authorization vulnerability. Search requests are transformed into SQL, Neo4J or Elasticsearch/Opensearch queries, and the Realms filter that should restrict results to the requester's permissions may be rendered as empty for non-recursive search requests, voiding privilege restrictions.

Apache Syncope has an improper privilege management vulnerability. Delegations can be created or updated with Roles not owned by the delegating User, or not for the same Realm subtree under which delegation management was granted.

Inadequate access control exists in Hiperdino's REST v1.0 API. The public endpoint 'customer/check' allows an authenticated attacker to enter a telephone number or email address; when the value belongs to a registered customer, the service returns the associated information (email address and telephone number). No authentication is required beyond a static bearer token, and there is no rate limiting or generic error handling.

LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visual_register WebSocket endpoint, which passes the first client frame directly to pickle.loads(). Attackers can reach the Config Server port and send a malicious serialized payload with a __reduce__ method to execute arbitrary code with Config Server process privileges.

An improper validation vulnerability exists in PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. In certain configurations this could allow an attacker to bypass authentication controls via spoofing, leading to privilege escalation or impersonation.

Bifrost registers MCP clients through its management API, where a stdio client is a command plus args that is started immediately upon client addition, with no MCP handshake required. Authentication is disabled by default (governance.auth_config.is_enabled=false), meaning every caller is treated as a local admin. A single unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).

Improper verification of cryptographic signature vulnerability in Apache Syncope. When SRA is configured for OAuth 2.0 without a JWKS set URI assigned, an attacker can forge arbitrary JWTs to impersonate any user identity and permissions, gaining full access to services proxied by SRA.

Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can spoof another user's privileges after completing a successful authentication and obtaining a valid JWT.

Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This may allow manipulation of graph database queries.

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort clauses for Task search.