CVE Vulnerability Catalog

In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation may allow access to decrypted sensitive configuration data, including credentials and service-related information.

In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may perform administrative actions such as creating privileged accounts or modifying critical configuration settings.

The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid credentials. Successful exploitation may allow an unauthenticated attacker to execute privileged operations and gain full control of the device.

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access personally identifying information about another local user in a collection because the controller used the general collection policy instead of the admin collection policy namespace. The exposed data included the other user's current email address and last-used IP address. This issue is fixed in versions 4.6.4 and 4.7.0-beta.1.

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive calculations. Anonymous callers could submit keys, start_at, and end_at parameters that caused long-running SQL queries in Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension, allowing repeated requests to exhaust server resources. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.

Unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process.

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handle_remote_echo accepts printable shell command characters and handle_remote_ssh calls get_ssh_data in kittens/ssh/utils.py, which emits a newline; chaining the handlers can execute attacker-controlled commands when a user displays untrusted terminal data. This issue is fixed in version 0.48.2.

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center functions across erpnext/accounts/doctype/account/account.py, erpnext/accounts/doctype/process_payment_reconciliation/process_payment_reconciliation.py, erpnext/accounts/doctype/purchase_invoice/purchase_invoice.py, and erpnext/accounts/utils.py omit required write permission checks, allowing authenticated limited users to modify protected data beyond their roles. This issue is fixed in versions 15.112.0 and 16.22.0.

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepare_conditions path in erpnext/accounts/report/accounts_receivable/accounts_receivable.py does not apply Customer and Supplier user permissions to the Payment Ledger Entry dynamic-link party field, allowing any authenticated user to read unauthorized cross-company financial data in Accounts Receivable and Accounts Payable reports. This issue is fixed in versions 15.112.0 and 16.23.0.

Tabby (formerly Terminus) before version 1.0.235 contains a path traversal vulnerability via a malicious SFTP server. The server can return filenames with backslashes, which are interpreted as path separators on Windows, allowing files to be created or overwritten outside the selected directory.

A vulnerability was found in libvirt where the virFileChownFiles() function follows symbolic links. A local attacker running as the swtpm user can plant a symlink in the swtpm state directory, causing the root-level libvirt daemon to change ownership of an arbitrary file to the swtpm user.

A vulnerability in RHOAI training-operator allows a user with standard edit or admin roles in any Kubernetes namespace to escalate privileges. By creating training jobs, an attacker can impersonate service accounts, access the host filesystem, and potentially execute arbitrary code remotely.

A vulnerability in the RHOAI overlay for the training operator incorrectly aggregates trainjobs management permissions into the native Kubernetes 'edit ClusterRole'. This allows any user with edit permissions in a namespace to create, modify, and delete TrainJobs, which combined with another vulnerability can lead to privilege escalation and remote code execution.

A vulnerability was found in odh-dashboard related to how RoleBindings are created. The system does not properly validate the 'roleRef' field, allowing a user to specify an arbitrary role, including highly privileged ones like 'cluster-admin'. This can lead to privilege escalation and persistent control over the system.

A vulnerability in odh-dashboard allows an attacker who has compromised the dashboard's Service Account (SA) token to exploit overly broad permissions granted to the SA. This enables privilege escalation to cluster-administrator level, access to sensitive data like credentials and keys, and disruption of multi-tenant isolation.

A vulnerability in Feast allows authorization bypass in the /materialize and /materialize-incremental endpoints. By sending a specially crafted request that omits the feature_views field, an attacker can bypass permission checks, allowing an unauthenticated remote attacker or any authenticated user to trigger a full re-materialization of all feature views. This results in a Denial of Service (DoS) due to data corruption and significant resource consumption.

A vulnerability in Feast and feast-operator is due to the default 'no_auth' configuration, which installs no security manager. This allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints. A remote attacker can exploit the missing authentication to achieve remote code execution (RCE) by storing a malicious UDF, trigger DoS by forcing re-materialization, and gain unauthorized access to cross-tenant data.

A vulnerability in Data Science Pipelines (DSP) allows an attacker with namespace editor privileges to bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy'. Successful exploitation grants the attacker node-root access, enabling arbitrary code execution and full control over the node.

A vulnerability in Data Science Pipelines involves improper authorization in the setDefaultServiceAccount function. A restricted user can specify a more privileged ServiceAccount (SA) during a CreateRun request, bypassing authorization checks. This allows the tenant to run containers with elevated privileges, potentially leading to disclosure of sensitive information (secrets) and execution of commands within other users' pods.

A flaw was found in ml-metadata where the statically-linked gRPC stack is outdated, making it vulnerable to known HTTP/2 denial of service (DoS) issues. An in-cluster attacker with network access to the MLMD pod could exploit this by sending specially crafted HTTP/2 requests, potentially crashing the pod and disrupting pipeline runs.