CVE Vulnerability Catalog

Plane, an open-source project management tool, has a vulnerability in the IssueBulkUpdateDateEndpoint that allows a project member to modify start_date and target_date of any issue across the entire instance, regardless of workspace or project membership. This affects versions prior to 1.3.0.

JWCrypto before 1.5.7 does not validate decompressed output size in JWE tokens with ZIP compression. An attacker can send a small token (under 250KB) that decompresses to about 100MB, causing server memory exhaustion.

WWBN AVideo, an open-source video platform, has a Server-Side Request Forgery (SSRF) vulnerability in the Live restream log callback flow. An authenticated streamer can store an arbitrary callback URL that is later fetched server-side. This affects versions 26.0 and prior.

AVideo is an open source video platform where the EPG feature parses XML from user-controlled URLs and renders programme titles directly into HTML without sanitization. A user with upload permission can set a malicious XML file with JavaScript in <title> elements. This affects versions 26.0 and prior.

WWBN AVideo versions 26.0 and prior have a vulnerability in the PayPal IPN v1 handler that lacks transaction deduplication. An attacker can replay a single IPN notification to repeatedly inflate wallet balance and renew subscriptions.

Vite, a frontend tooling framework for JavaScript, versions 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, has a vulnerability in handling .map requests for optimized dependencies. The dev server resolves file paths and calls readFile without restricting ../ segments in the URL, allowing bypass of the server.fs.strict allow list and retrieval of .map files outside the project root if they can be parsed as valid source map JSON.

Semtech LR11xx LoRa transceivers with early firmware versions have an information disclosure vulnerability in firmware validation. After a firmware validity check command via SPI, the last decrypted block remains in memory, allowing an attacker with SPI access to read the decrypted firmware.

Semtech LoRa LR11xxx transceivers with early firmware versions have improper access control allowing stack memory writes via the SPI interface. An attacker with physical access can hijack program flow and execute arbitrary code, but changes are lost on reboot.

The ReportIncident extension in Wikimedia Foundation MediaWiki has an allocation of resources without limits vulnerability, allowing HTTP DoS attacks. The fix is only available on the master branch.

RustFS is a distributed object storage system where prior to alpha.90, there is a missing authorization check in the multipart copy path (UploadPartCopy). A low-privileged user who cannot read objects from a victim bucket can copy victim objects into an attacker-controlled multipart upload and complete the upload.

Scoold, a Q&A and knowledge sharing platform for teams, has an authorization flaw that allows any logged-in, low-privilege user to overwrite another user's existing question by supplying its public ID as the postId parameter. This affects versions prior to 1.66.2.

OrangeHRM Open Source versions 5.0 through 5.8 omit authorization on job specification and vacancy attachment download handlers. Authenticated low-privilege users can read attachments via direct reference to attachment identifiers.

OrangeHRM Open Source from 5.0 to 5.8 allowed authenticated users to bypass disabled-module access controls via URL-encoded request paths and access functionality of modules disabled by an administrator. Fixed in 5.8.1.

OrangeHRM Open Source versions 5.0 to 5.8 fail to restrict email template file resolution to the intended plugins directory, allowing an authenticated attacker who can influence the template path to read arbitrary local files. This is fixed in version 5.8.1.

Improper neutralization of alternate XSS syntax vulnerability in The Wikimedia Foundation Mediawiki - Wikilove Extension allows Cross-Site Scripting (XSS). The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.

OpenViking versions prior to 0.3.3 have a missing authorization vulnerability in task polling endpoints. Unauthenticated attackers can enumerate or retrieve background task metadata created by other users, including task type, status, resource identifiers, archive URIs, result payloads, and error information.

The Backup Migration plugin for WordPress up to version 2.0.0 has a missing authorization in the initializeOfflineAjax function and lacks nonce verification. The endpoint only validates hardcoded tokens publicly exposed in the plugin's JavaScript, allowing unauthenticated attackers to trigger backup upload queue processing, potentially causing unexpected transfers to configured cloud storage targets and resource exhaustion.

Libarchive has a NULL pointer dereference vulnerability in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare 'd' or 'default' tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash.

Nokia MantaRay NM is vulnerable to a Relative Path Traversal vulnerability due to improper validation of input parameter on the file system in Software Manager application.

The Popup Box WordPress plugin before version 5.5.0 does not properly validate nonces in the add_or_edit_popupbox() function before saving popup data, allowing unauthenticated attackers to perform CSRF attacks. When an authenticated admin visits a malicious page, the attacker can create or modify popups with arbitrary JavaScript that executes in the admin panel and frontend.