CVE Vulnerability Catalog

A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL access to the unauthorized page.

An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, configuration variables) via unprotected endpoints lacking adequate security headers.

Gibbon before version 30.0.01 has a path traversal vulnerability leading to DoS by attempting extraction of PHP files. Failed .zip extraction results in file deletion and DoS. Teacher or higher privileges required.

Argo Workflows from version 4.0.0 to before 4.0.5 logs all artifact repository credentials (S3 access keys, secret keys, GCS service account keys, Azure account keys, Git passwords, etc.) in plaintext during artifact operations. Any user with read access to workflow pod logs can extract these credentials. This is fixed in version 4.0.5.

Argo Workflows versions 4.0.0 to 4.0.5 have a nil pointer dereference in rbacAuthorization() in server/auth/gatekeeper.go, causing a panic (denial of service) for SSO users whose claims match a namespace-level RBAC rule but not an SSO-namespace rule when SSO_DELEGATE_RBAC_TO_NAMESPACE=true.

Kirby CMS before versions 4.9.0 and 5.4.0 does not check user permissions for avatar creation, replacement, and deletion. Any user can modify others' avatars without proper rights.

In Kirby (content management system) versions prior to 4.9.0 and 5.4.0, the `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API.

Kirby prior to versions 4.9.0 and 5.4.0 does not gate read access to site, user and role information by permissions, allowing unauthorized users to access this data.

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, the system API endpoint leaks license data and installed version to authenticated users. This issue has been patched in versions 4.9.0 and 5.4.0.

The LatePoint plugin for WordPress up to version 5.5.0 is vulnerable to account takeover due to a weak password recovery mechanism in the unauthenticated guest booking flow. The save_connected_wordpress_user() function propagates a LatePoint customer's email to the linked WordPress user account without ownership verification, and the guest booking flow can overwrite an existing customer's email via phone-based merge without authentication.

PgBouncer before 1.25.2 did not properly authorize the KILL_CLIENT admin command. Any user with access to the admin console could run it, instead of only users in the admin_users list.

In PgBouncer before version 1.25.2, a null pointer dereference could cause a crash if a server sends an error response without the SQLSTATE field.

In Vim prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer multiplication, causing a small buffer to be allocated for a write loop that runs many iterations, overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can trigger spell file loading if a malicious .spl file has been planted on the runtimepath.

In Vim prior to version 9.2.0435, an OS command injection vulnerability exists in the :find command-line completion. When the path option contains backtick-enclosed shell commands, they are executed during file name completion. Because the path option lacks the P_SECURE flag, it can be set from a modeline, allowing arbitrary command execution when the user opens a file and triggers :find completion.

FastGPT before 4.14.17 has an inconsistent SSRF protection gap in MCP tool URL handling. Preview/run endpoints reject internal URLs, but create/update endpoints can save an internal URL that is later used without revalidation.

An IDOR vulnerability in AnythingLLM before version 1.12.1 allows an authenticated user to access another user's assistant response in audio form. The GET /api/workspace/:slug/tts/:chatId endpoint does not enforce chat ownership, only workspace membership.

Grimmory, a self-hosted digital library, prior to version 2.3.1 contains a stored cross-site scripting (XSS) vulnerability in its browser-based EPUB reader. This allows an attacker to embed arbitrary JavaScript in a crafted EPUB file. When a victim opens the book, the script executes in their browser with full access to the Grimmory application's session context. This can enable session token theft and account takeover, including administrative access if an administrator opens the affected book. This issue has been patched in version 2.3.1.

Kargo before versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2 is vulnerable to open redirect in the UI OIDC login flow via the 'redirectTo' query parameter.

Postiz is an AI social media scheduling tool. In versions from 2.16.6 to 2.21.6, SSRF protections have a TOCTOU vulnerability: the isSafePublicHttpsUrl() function resolves DNS to validate the IP, but subsequent fetch() calls resolve DNS independently. An attacker controlling a DNS server can exploit this via DNS rebinding to redirect requests to internal network addresses. This issue has been patched in version 2.21.7.

FastGPT versions up to 4.14.11 are vulnerable to DNS rebinding (TOCTOU) in the isInternalAddress() function. The function checks the IP before the HTTP request, but a new DNS resolution during the request may return a different address, bypassing validation. No public patches available.