CVE Vulnerability Catalog

Dell ThinOS 10 versions prior to 2605_10.2100 contain a Protection Mechanism Failure vulnerability. An attacker with physical access could exploit this flaw to gain unauthorized access to encrypted data.

In Splunk Enterprise and Splunk Cloud Platform, a vulnerability allows a low-privileged user (without 'admin' or 'power' roles) to view stored credential hashes. This occurs when the user accesses the `/servicesNS/-/-/storage/passwords` REST endpoint via the `|rest` SPL command, which returns the `encr_password` field.

The Pegatron `Tdelo64.sys` driver exposes a privileged device interface `\\.\TdeIo` that fails to restrict access to sensitive IOCTL functionality. Lack of privilege validation and kernel memory address verification allows a local attacker to perform arbitrary kernel memory read and write operations.

In SurrealDB prior to version 3.1.0, when a node is deleted, the Document::purge_edges function automatically removes associated graph edges, bypassing the PERMISSIONS FOR delete and PERMISSIONS FOR select clauses defined on the edge table. This occurs because the operation runs with permissions disabled (opt.clone().with_perms(false)).

Prior to version 0.107.75, AdGuard Home's client-triggered DoQ forwarding path to a udp:// upstream reduced backend UDP DNS state by producing dns_id=0 or txid=0 and exposed a quoted-port ICMP source-port oracle, weakening DNS response matching for forwarded queries.

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) allows an authenticated remote attacker to perform path traversal attacks on the underlying operating system. The attacker can read or delete arbitrary files by sending a crafted HTTP request.

Reflected XSS vulnerability in Pega Platform versions 8.1.0 through 25.1.2 affects a user interface component. Requires a high privileged user with a developer role.

Stored XSS vulnerability in Pega Platform versions 8.1.0 through 25.1.2 affects a user interface component. Requires a high privileged user with a developer role.

In Apollo Portal prior to version 2.5.0, a vulnerability exists due to missing permission checks for applications and namespaces when fetching a release by its ID. An authenticated low-privileged user can read configuration data from other applications if they know or guess a valid releaseId, bypassing the UserPermissionValidator.shouldHideConfigToCurrentUser(...) mechanism.

A reflected Cross-Site Scripting (XSS) vulnerability in HCL Notes is caused by improper input neutralization during web page generation. Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of another user.

A vulnerability in File Browser from version 2.63.6 to 2.63.16 allows a user with upload permission to plant a backslash-named file that escapes the extraction directory when another user downloads and extracts the generated archive. The issue stems from the use of strings.ReplaceAll(nameInArchive, "\", "/") in the archive builder, which turns a POSIX filename such as ..\..\evil.sh into the archive entry ../../evil.sh.

An SSRF vulnerability in Vaultwarden before version 1.36.0 allowed bypassing IP address validation in decimal, hexadecimal, and octal formats during icon fetching, enabling internal network and port scanning.

A vulnerability in Vaultwarden prior to version 1.36.0 allowed SSO discovery and pre-validation flow to leak organization-related SSO metadata, including organizationIdentifier values, for arbitrary email addresses. This enabled obtaining a valid pre-validation JWT with only the discovered identifier, facilitating SSO-enabled organization enumeration and authentication workflow abuse.

Zen Browser prior to version 1.19.13b did not provide a persistent, clearly visible security notification when a webpage entered fullscreen mode. This allowed an attacker-controlled page to hide the real browser UI and origin information, imitate a trusted website UI, and combine with long-domain URL eliding to spoof a trusted origin for phishing and credential theft.

A vulnerability in Stirling-PDF before version 2.0.0 allowed JavaScript injection via PDF title and author metadata fields. An attacker can craft a malicious PDF that, when its info is viewed in the web interface, executes code in the victim's browser.

Flameshot prior to version 14.0.0 has a vulnerability in the 'Open With' feature that writes screenshots to a predictable temporary path and follows symlinks. This allows a local unprivileged attacker on the same machine to pre-plant a symlink and overwrite any file the victim user can write.

FastGPT before version 4.15.0-beta5 has an SSRF vulnerability where the guard validates only the initial request URL, and axios follows redirects by default. An authenticated workflow user can configure an HTTP request node to call an attacker-controlled public URL that redirects to cloud metadata, loopback, or internal services that the guard would block on direct request, and the HTTP node returns the response body to the workflow caller.

The NGINX Agent config_dirs directive allows a low-privileged attacker to gain limited read and write access to files outside of the designated secure directory. This directive can also be configured through NGINX Instance Manager. A successful exploit may allow an attacker to cross a security boundary.

A vulnerability exists in NGINX Plus and NGINX Open Source within the ngx_http_ssi_module module. This issue occurs when Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. An unauthenticated attacker with man-in-the-middle (MITM) capability to control upstream server responses may trigger a use-after-free in the NGINX worker process.

Cloudreve before version 4.16.1 allows non-admin users with remote download permission to fetch internal-only URLs (e.g., localhost, loopback) via the POST /api/v4/workflow/download endpoint. The vulnerability is due to missing blocking of loopback, localhost, IPv6 localhost, and redirect-to-loopback targets.