CVE Vulnerability Catalog

Local File Inclusion (LFI) vulnerability in LogicalDOC Enterprise up to and including version 9.1.1, present in the OnlyOfficeEditor servlet. Allows an authenticated user to exploit a path traversal flaw in the fileExt parameter to read files outside allowed directories.

A broken access control vulnerability in Perfect Support Ticketing & Document Management System through version 1.7 allows authenticated attackers with Agent-level privileges to bypass authorization checks and manipulate the Support Agent assignment field of tickets. Attackers can add or remove any user, including Superadmin accounts, from the Support Agent field of any ticket they are assigned to.

Perfect Support Ticketing & Document Management System through version 1.7 contains a stored cross-site scripting vulnerability. Authenticated attackers with Agent-level privileges can inject malicious payloads into the Notes field of assigned support tickets, which execute in the browser context of any user viewing those notes, including Superadmin users.

In SimpleChat prior to version 0.241.203, the authenticated GET /api/user/info/<user_id> and GET /api/user/profile-image/<user_id> endpoints lacked object-level authorization. A low-privilege authenticated user could supply an arbitrary user_id and read the corresponding Cosmos DB user-settings document, retrieving another user's email address, display name, and profile image.

In the Microsoft UFO framework before version 3.0.7, the COMMAND_RESULTS handler calls get_or_create_session without owner_client_id, allowing an authenticated client to create a session with an arbitrary name (e.g., constellation_task_id = f"{task_name}@{task_id}"). This can lead to denial of service for the legitimate owner or memory exhaustion from phantom sessions.

In Microsoft UFO framework versions 3.0.0 through 3.0.6, a vulnerability was found due to missing object-level authorization. A client connected as a DEVICE to the WebSocket server could send a DEVICE_INFO_REQUEST with another device's target_id and obtain its system information.

An Open Redirect vulnerability (CWE-601) was found in the OAuth/OIDC authentication implementation of Axivion Dashboard. The login flow did not properly restrict post-authentication redirects to the application's own origin, allowing a user who follows a crafted login link to be sent to an untrusted external site after authenticating against the genuine Dashboard.

The vulnerability allows an authenticated user to bypass authorization by manipulating numeric IDs in REST API endpoints. The Order and OrderItem controllers in Prospero Flow CRM before version 5.5.3 do not verify record ownership by the user's company, enabling reading, modifying, and deleting orders and order items belonging to other tenants.

HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application leaks sensitive information about its internal file structure through unhandled errors, logs, or debug output, allowing a remote attacker to map the server environment.

HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service (DoS). The application fails to properly validate input sizes, allowing an attacker to pass an excessive amount of information into a memory container, which can cause the system to crash or become unresponsive.

HCL DFXAnalytics uses deprecated TLS 1.0 and TLS 1.1 protocols, which have numerous cryptographic flaws. This allows interception and decryption of transmitted data.

HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter HTTP responses to bypass authentication and authorization controls, gaining unauthorized access to user accounts.

An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper with the secret bearer token embedded directly in the cleartext URL passed via command-line arguments (argv). On systems with a default-mounted /proc filesystem where process-hiding mitigations (hidepid) are disabled, an unprivileged local attacker can monitor system processes and read the sensitive bearer token from /proc/cmdline while the helper process is running.

A vulnerability in the ubuntu-pro-client (formerly ubuntu-advantage-tools) pro collect-logs command allows an unprivileged local attacker to create a symbolic link to root-readable files (e.g., /etc/shadow). When an administrator runs the tool, it follows the symlink and includes the sensitive file contents in the diagnostic archive, which is then accessible to the attacker.

A vulnerability in Stoatchat before version 0.7.8 allows attackers to bypass account creation restrictions such as invite-only mode, email verification, captcha, and shield verification. This enables unlimited account creation with unverified email addresses, increasing the risk of denial-of-service attacks and compromising service integrity.

A vulnerability in the Mint library (versions 0.1.0 through 1.9.2) allows HTTP response smuggling by accepting a plus/minus sign in the chunk-size line of Transfer-Encoding: chunked. A malicious HTTP/1 server can exploit this interpretation mismatch to poison the response queue on a shared keep-alive connection, causing subsequent requests to receive forged responses.

HCL DFXServer is vulnerable to missing access control. Certain endpoints are accessible without any authentication in another browser, allowing any network user to invoke these APIs and interact with the application without identity verification.

An unencrypted communication vulnerability in HCL DFXServer. The application allows connections over unencrypted HTTP, which could allow an attacker to intercept network traffic and sensitive data.

A use-after-free vulnerability in ESET Linux products could potentially allow an attacker to trigger a kernel panic on the system.

The WP Bulk Delete plugin for WordPress is vulnerable to generic SQL Injection via the 'delete_user_roles' parameter in all versions up to and including 1.4.2 due to insufficient escaping and lack of proper SQL query preparation. This allows authenticated attackers with administrator-level access to append additional SQL queries to extract sensitive information from the database.