CVE Vulnerability Catalog

A vulnerability has been found in RTGS2017 NagaAgent up to version 5.1.0, affecting unknown processing of the file apiserver/routes/extensions.py in the Skills Endpoint component. Manipulation of the argument Name leads to path traversal.

Improper privilege management in the log rotation mechanism of the Skylight Workspace Config Service in Amazon WorkSpaces for Windows before version 2.6.2034.0 allows a local non-admin authenticated user to place arbitrary files into arbitrary locations, bypassing file system permission protections.

Boundary Community Edition and Boundary Enterprise workers are vulnerable to a denial-of-service attack during TLS handshake for node enrollment. An attacker with network access may delay or withhold the client certificate, causing worker connection handling to block.

In version 2.3.5 of the Nginx user interface (nginx-ui), there is an unauthenticated bootstrap takeover vulnerability during the initial installation exposed by POST /api/install.

Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the initial administrator account on a fresh nginx-ui instance during the first-run setup window.

W bibliotece @fastify/accepts-serializer występuje problem z nieograniczonym buforowaniem wyników wyboru serializatora, co może prowadzić do wyczerpania pamięci w Node.js. Zdalny, nieautoryzowany klient może wysłać wiele różnych nagłówków Accept, co spowoduje niekontrolowany wzrost pamięci podręcznej.

In the fast-uri library, the normalize() and equal() functions decoded percent-encoded path separators and dot segments before applying dot-segment removal. Encoded path data was treated as real slashes and parent-directory references, causing distinct URIs to collapse onto the same normalized path. Versions up to 3.1.0 are affected.

The WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains a stack-based buffer overflow vulnerability in the firewall.cgi and makeRequest.cgi binaries that allows unauthenticated attackers to overwrite the saved return address by sending a POST request with a Content-Length header exceeding 512 bytes.

IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API does not enforce binding between the authenticated subject and the targeted user/tenant.

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create or modify workflows containing a Python Code Node could escape the sandbox and achieve arbitrary code execution on the task runner container.

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the XML Node leading to RCE when combined with other nodes exploiting the prototype pollution. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

n8n is a workflow automation platform that prior to versions 1.123.32, 2.17.4, and 2.18.1 had a flaw in the xml2js library allowing prototype pollution via a crafted XML payload. An authenticated user with the right permissions could exploit this to achieve remote code execution on the n8n host.

n8n is an open source workflow automation platform. Prior to versions 1.123.33 and 2.17.5, the dynamic-node-parameters endpoints did not verify whether the authenticated caller was authorized to use a supplied credential reference. This allowed an attacker to use another user's credentials for authentication against attacker-controlled infrastructure.

Prometheus before versions 3.5.3 and 3.11.3 does not validate the declared decoded length in a snappy-compressed request to the /api/v1/read endpoint before allocating memory. An unauthenticated attacker can send a small payload causing a huge heap allocation, potentially exhausting memory and crashing the Prometheus process under concurrent load.

Prometheus prior to versions 3.5.3 and 3.11.3 stores the client_secret field in Azure AD OAuth configuration as a plain string instead of a Secret. This exposes the Azure OAuth client secret in plaintext to any user or process with access to the /-/config endpoint.

Wersja 2.10 i wcześniejsze OpenSTAManager zawierają podatność na nieautoryzowane przesyłanie plików w funkcjonalności aktualizacji modułów (modules/aggiornamenti/upload_modules.php).

The Conditional Fields for Contact Form 7 WordPress plugin through version 2.7.2 contains an uncontrolled resource consumption vulnerability in the Wpcf7cfMailParser class. The hide_hidden_mail_fields_regex_callback() method reads an iteration count directly from user-supplied POST parameters without validation, allowing unauthenticated attackers to execute unbounded loops.

Detect-It-Easy w wersjach przed 3.21 zawiera podatność na traversję ścieżek, która umożliwia atakującym zapis dowolnych plików w systemie plików poprzez stworzenie złośliwych wpisów archiwum z relatywnymi sekwencjami traversji lub absolutnymi ścieżkami. Atakujący mogą wykorzystać niewystarczającą normalizację ścieżek podczas ekstrakcji archiwum, aby zapisać pliki poza zamierzonym katalogiem ekstrakcji.

OpenC3 COSMOS prior to versions 6.10.5 and 7.0.0-rc3 allowed users to change their password without providing the old password, accepting only a valid session token. This behavior can be exploited by an attacker who has a valid session token to hijack accounts and block legitimate users from accessing their accounts.

The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains an information disclosure vulnerability in the QR code scanning endpoint that allows unauthenticated attackers to enumerate and retrieve all customer order records.