CVE Vulnerability Catalog

Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the web_fetch tool, allowing attackers to reach internal hosts via URL redirection to loopback or private addresses, exploiting automatic HTTP redirect following.

A security flaw in code-projects Hotel and Tourism Reservation System 1.0 in file /ht/tour.php allows cross site scripting via manipulation of arguments name, email, people, number. Remote attack is possible and exploit is public.

CodeAstro Payroll System 1.0 has a SQL Injection vulnerability in an unknown part of /home_employee.php. Manipulation of the emp_id argument allows remote attackers to inject SQL code. The exploit has been published and may be used.

In DevaslanPHP project-management up to 2.0.0-beta1, an improper authorization vulnerability was found in the KanbanScrumHelper::recordUpdated function in app/Helpers/KanbanScrumHelper.php. The attack can be performed remotely. The project has not responded.

In DevaslanPHP project-management up to 2.0.0-beta1, an improper authorization vulnerability was found in the editComment/doDeleteComment functions in app/Filament/Resources/TicketResource/Pages/ViewTicket.php. The attack can be performed remotely. The project has not responded.

Nextcloud Server before versions 31.0.12 and 32.0.3 has a missing check of a relation, allowing authenticated users with access to any file comment to read the content of all comments.

Thor Vector Graphics (ThorVG) before version 1.0.5 has a null pointer dereference vulnerability in SvgLoader::run(). Any caller passing untrusted SVG data to Picture::load() can crash the process with a 6-byte payload.

In Nextcloud Server before versions 32.0.9 and 33.0.3, a pre-2FA session cookie can be reused as a Bearer token to authenticate against DAV endpoints, bypassing mandatory two-factor authentication.

In Nextcloud Server before versions 32.0.9 and 33.0.3, an attacker with knowledge of a user's password can bypass two-factor authentication by extracting a temporary session token and replaying it via HTTP Basic Authentication.

Nextcloud Tables from version 0.8.0 to before 1.0.4 exposes view filter criteria to users with read-only permissions. This issue is patched in versions 1.0.4 and 2.0.0.

Nextcloud from version 4.3.0 to before 5.2.7 allows a removed collaborator to retain unauthorized read access to uploaded respondent files for the affected form. The scope is limited to forms where that user previously had results access.

Nextcloud is an open source content collaboration platform. From versions 5.5.13 to before 5.5.17, and 6.2.0 to before 6.2.3, an authenticated user can enumerate users on the same Nextcloud instance by using the Calendar app's endpoint for suggesting attendees.

In Nextcloud Server before versions 32.0.9 and 33.0.3, sharing a folder or file with a team containing an external member automatically creates a public link that is invisible to the owner and cannot be revoked, granting full permissions.

In Nextcloud from version 1.3.6 to before 8.4.0, an improper check allowed users provided by LDAP to still authenticate via OIDC after being deleted from LDAP.

Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the ownership of files when processing DAV lock and unlock requests. An authenticated user could lock or unlock files belonging to other users by targeting their absolute WebDAV paths. Additionally, lock tokens were disclosed to unauthorized callers in error responses, allowing attackers to remove token-based locks placed by other users' client applications. It is recommended that the Nextcloud Server is upgraded to 32.0.2 or 33.0.1. It is recommended that the Nextcloud Enterprise Server is upgraded to 31.0.14.4 or 32.0.2 or 33.0.1.

In Nextcloud Server before versions 32.0.9 and 33.0.3, an authenticated attacker can access attachments of link shares when knowing the share token, bypassing password protection or download restrictions.

In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory config value, non-admin users can in some cases copy arbitrary files (depending on unix permissions) into their own Nextcloud directory via a path traversal.

In the Nextcloud Approval app prior to version 2.7.2, a privilege escalation vulnerability allows a user without sharing permissions to force the system to share a file with approvers.

CodexBar before version 0.32.0 contains a session cookie leakage vulnerability, allowing network attackers to intercept imported browser session cookies via improper redirect handling for Amp and Ollama provider sessions.

Vulnerability in Spring Cloud Function allows an OOM (Out of Memory) error by attempting to add an infinite number of functions to the Function Registry. It affects multiple versions of the library.