CVE Vulnerability Catalog

Mantis Bug Tracker (MantisBT) versions up to 2.28.1 allow an authenticated user to upload attachments to private issues they are not authorized to access.

The Colorbox Inline module for Drupal is vulnerable to Cross-Site Scripting (XSS) in all versions before 2.1.1. The vulnerability is due to improper neutralization of input during web page generation.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Obfuscate allows Cross-Site Scripting (XSS). This issue affects Obfuscate: from 0.0.0 before 2.0.2.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 11.3.0 before 11.3.7.

Improperly controlled modification of dynamically-determined object attributes vulnerability in Drupal core allows object injection. Affects versions from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, and from 11.3.0 before 11.3.7.

Drupal core versions 8.0.0 to 10.5.9, 10.6.0 to 10.6.7, 11.0.0 to 11.2.11, and 11.3.0 to 11.3.7 are vulnerable to Cross-Site Scripting (XSS) due to improper input neutralization during page generation.

Cross-site scripting vulnerability in Drupal Orejime before version 2.0.16. Improper input neutralization during page generation allows injection of malicious scripts.

Mantis Bug Tracker (MantisBT) versions 2.28.1 and earlier allow a user to list and download their own attachments from an issue created by another user even after it becomes private, bypassing read access revocation. The confidentiality impact is minimal as only the user's own attachments are accessible. This is fixed in version 2.82.2.

Joplin versions 3.5.2 and earlier contain a logic error in the delta API that allows share recipients to download notes that are no longer shared with them. The flaw stems from improper filtering of item state and change compression, leading to data leakage.

Mantis Bug Tracker (MantisBT) versions 2.28.1 and earlier are vulnerable to authorization bypass via the private issue monitoring feature. A user with project-level access can add themselves as a monitor for a private issue they cannot access by sending a crafted POST request to bug_monitor_add.php. Despite an Access Denied error, the monitor relationship is created, leading to email notifications that disclose private issue metadata and content. This is fixed in version 2.28.2.

Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected. The html_filter function did not escape single quotes, so HTML attributes inside single quotes could have code injected, e.g. the variable "var" in <a id='ref' title='[% var | html %]'> would not be properly escaped. Arbitrary HTML and JavaScript injection is difficult because angle brackets, ampersands and double-quotes are still escaped.

In Mantis Bug Tracker (MantisBT) versions 2.28.1 and prior, a privilege escalation vulnerability exists. Users with manage_project_threshold access level (manager by default) can grant project-level administrator access to any user in any project they manage. The issue has been fixed in version 2.28.2.

CtrlPanel (open-source billing software for hosting providers) versions 1.1.1 and prior contain a stored XSS vulnerability in the admin role management interface. The datatable() method in RoleController.php interpolates role name and color directly into HTML without sanitization, and .rawColumns(['actions', 'name']) disables automatic escaping. An admin with role creation or edit permissions can inject malicious code that executes on every load of the /admin/roles page by any admin.

Ledger Nano X, Flex, and Stax devices contain a denial of service vulnerability in the MCU firmware update process due to missing validation of the reset_handler parameter during flashing. An attacker can provide a crafted reset_handler address pointing to invalid memory or attacker-controlled code, causing an unrecoverable fault state during boot and permanent loss of operability.

Improper input validation in SMM communications buffer could allow a privileged attacker to perform out-of-bounds read/write in TSEG memory, potentially compromising confidentiality or integrity.

Ledger Live with vulnerable versions of ledgerhq/hw-app-eth prior to 6.34.7 contains an integer parsing vulnerability that allows attackers to manipulate EIP-712 typed data messages by exploiting incorrect hexadecimal field parsing when values contain an odd number of characters. Attackers can obtain signatures on truncated or misinterpreted message values to authorize unintended blockchain transactions.

CtrlPanel open-source billing software for hosting providers, versions 1.1.1 and prior, exposes multiple admin DataTable endpoints without authorization checks, allowing any authenticated user to access sensitive administrative data.

CtrlPanel versions up to 1.1.1 contain a remote code execution (RCE) vulnerability in the admin settings update endpoint. The vulnerability is due to missing validation of the loaded class, allowing an authenticated admin to dynamically call any class available in the Composer autoloader, potentially leading to code execution.

In libheif before version 1.22.0, when decoding a HEIF grid image with strict_decoding=false, a corrupted tile silently fails and the library returns heif_error_Ok with no indication of failure, leading to an uninitialized heap memory information leak. The Y, Cb, and Cr planes are not zeroed, so heap data appears in pixel values.

Joplin, an open-source note-taking and to-do application, versions 3.6.14 and prior, contains a Denial of Service (DoS) vulnerability in the note title input due to missing length validation. An attacker can cause an Out Of Memory (OOM) error and program termination by inserting an excessively long string into a note's title, either via the UI or through the local web service API (port 41184) after compromising an authentication token. The issue is fixed in version 3.7.1.