CVE Vulnerability Catalog

A path traversal vulnerability exists in the Mautic Asset API. When creating a local asset through the API, the supplied file path is not restricted to the asset upload directory. An authenticated API user with permission to create assets can register any file that is readable by the web server process as a Mautic asset. When the asset is published, its public download URL serves the contents of that file without authentication. This allows the attacker to read arbitrary files from the server, including Mautic configuration files containing the database password, secret key, and mail (SMTP) credentials, as well as system files and any other file readable by the web server user. Exposed credentials can be used to access the database or other connected services, and anyone with the public asset URL can retrieve the file contents.

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. The chunked reader in lib/bandit/http1/socket.ex takes the chunk-size line to be everything up to the first CRLF and discards everything after ; without checking it against the RFC 9112 chunk-ext grammar, so bare LF, bare CR and other control bytes pass. A proxy that ends the size line at a bare LF reads 2;\nxx\r\n40\r\n... as one request whose second chunk holds a GET /admin, while Bandit ends the body early and dispatches GET /admin as a separate pipelined request. Deployments without such a proxy in front of Bandit are not affected.

Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_redirect enabled, hackney:follow_redirect/10 in src/hackney.erl reissues the request to the Location target after hackney:maybe_strip_auth_on_redirect/3, which compared only the hostname of the current and the redirect URL. A redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. location_trusted forwards credentials to any target by design and is unchanged.

Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSock handler code after the server has stopped its connection, via data frames sent after ignoring the server's Close frame. When a WebSock callback returns {:stop, ...}, Bandit.WebSocket.Connection calls terminate/2, sends Close and shuts down the write side, but keeps the connection process running in a :closing state. handle_frame/3 and handle_info/3 never check that state, so later frames still reach handle_in/2 and later messages reach handle_info/2, with the state from the stop tuple, until the client sends Close, TCP drops or the idle timeout fires. A client refused in init/1 after a failed token check could still run an admin-only action.

A flaw was found in HaschekSolutions PictShare up to 3.7.1 in the architect function of src/inc/core.php within the File Upload component. The manipulation causes a race condition, and the attack can be initiated remotely. Attack complexity is rated high and exploitability difficult; the exploit has been published and may be used.

A vulnerability was detected in libimobiledevice up to 1.4.0 in the webinspector_receive_with_timeout function of src/webinspector.c within the Web Inspector component. The manipulation results in a heap-based buffer overflow, and the attack can be launched remotely. The exploit is public and may be used; the vendor did not respond.

Frappe Builder before 1.36.1 contains an SSRF vulnerability in builder/api.py where assert_not_private_url() validates only the initial hostname before requests.get(url) follows redirects with no IP pinning. An authenticated attacker can call the convert_to_webp endpoint (lacking a permission decorator) with a URL redirecting to internal targets such as cloud metadata services, enabling SSRF, internal port scanning, or request-hang DoS due to the missing timeout.

Frappe Builder versions 1.33.0 before 1.36.0 contain a missing authorization vulnerability in the improve_prompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without permission checks. Attackers can call the improve_prompt API to leverage the site owner's stored OpenRouter API key via resolve_api_key, consuming paid LLM credits and turning the site into a free LLM proxy.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Logsign SIEM affects versions from 6.4.120 before 6.4.122. It may allow access to files outside the intended directory.

The Mendix SAML module (Mendix 9, 10, and 11 compatible versions before V3.6.29 and V4.2.4 respectively) does not properly protect against SAML assertion replay in IdP-initiated authentication flows. This could allow unauthenticated remote attackers to gain unauthorized access by replaying a valid SAML response.

In libimobiledevice up to 1.4.0, the function afc_get_device_info_key in src/afc.c (Device Info Handler component) has a flaw where manipulation of the Value argument results in memory corruption. The attack requires local access, and a public exploit has been released. The vendor did not respond to the disclosure.

In libimobiledevice up to 1.4.0, an unknown part of src/afc.c (AFC component) contains a heap-based buffer overflow. The attack can be executed remotely, and a public exploit is available. The vendor did not respond to the disclosure.

The B Slider plugin (through 2.2.2) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious code can be stored and executed in a user's browser.

The APIExperts Square for WooCommerce (woosquare) plugin through version 4.7.5 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The APIExperts Square for WooCommerce (woosquare) plugin through version 4.7.5 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The Panorama Viewer – 360 Degree Image + Video Viewer plugin through version 1.8.3 contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation.

The Advanced Post Block - Post Grid for WordPress block editor plugin through version 2.5.1 contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation.

The Geo Mashup plugin through version 1.13.22 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The Geo Mashup plugin through version 1.13.22 contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation.

The Lazy Load for Videos plugin through version 2.18.11 contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation.