CVE Vulnerability Catalog

BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory. Its path-containment check did not resolve `..`, so a crafted `CODE_REPOSITORY` URL could traverse out of the intended folder.

The vulnerability in BBOT's unarchive module fails to detect symlinks in zip and 7z archives when their listing carries a DOS-attribute prefix before the unix mode, as produced by legacy p7zip versions. This allows an attacker-controlled symlink to be written into the extraction directory when such an archive is downloaded and extracted during a scan, bypassing the guard.

A heap buffer overflow vulnerability in ImageMagick before 7.1.2-19 exists in the FTXT encoder due to missing boundary checks when parsing ftxt:format. Remote attackers can trigger an out-of-bounds read by crafting malicious FTXT image files, leading to denial of service or information disclosure.

In ImageMagick before version 7.1.2-15, there is a heap-buffer-overflow read vulnerability in the GetPixelIndex function. The issue arises because OpenPixelCache updates image channel metadata before allocating pixel cache memory. Attackers can trigger memory and disk allocation failures, causing a heap-buffer-overflow read that affects any writer calling GetPixelIndex.

A path traversal vulnerability in Dell PowerProtect Data Domain allows a highly privileged remote attacker to modify files outside the restricted directory. The issue affects multiple versions including LTS2024, LTS2025, and LTS2026 releases.

In 389 Directory Server, the PBKDF2-SHA256 password verification function uses standard memcmp() instead of a constant-time comparison function. This allows a remote attacker to potentially infer partial hash information by measuring response times of LDAP bind requests.

A vulnerability in OpenSSH before version 10.4 allows remote attackers to cause a denial of service (DoS) via excessive GSSAPI authentication attempts. The issue stems from improper handling of the MaxAuthTries limit for GSSAPIAuthentication.

Anki prior to version 25.09.3 runs a local HTTP server that does not sufficiently block requests from other origins. A malicious website could send requests to this server, potentially causing side effects.

The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.

A vulnerability in Dashy before version 4.3.7 allows JavaScript execution in the application's origin context by passing a malicious URL in the 'url' parameter of the workspace view. An attacker can exploit this to steal browser data, manipulate the DOM, or send requests on behalf of the victim.

A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function has an inverted boolean condition, accepting SDP offers without the required a=fingerprint attribute and rejecting those with it. An attacker can manipulate WebRTC signaling to bypass DTLS certificate fingerprint binding.

A vulnerability was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies even when the incoming request carries unrelated cookies, allowing remote attackers to read private data from the shared cache.

In Coolify prior to version 4.0.0-beta.474, database credential fields (redis_password, keydb_password, dragonfly_password, clickhouse_admin_user, clickhouse_admin_password, postgres_user, mysql_user) are validated only as 'string' with no shell-safety checks. These values are then interpolated directly into Docker Compose YAML command strings without any escaping, allowing command injection.

An uncaught exception in the diagnostic web interface of Controller 6000 and Controller 7000 allows an authenticated and authorized operator to trigger a controller restart by sending specific requests, resulting in a temporary denial of service.

An uncaught exception in T20 Readers allows an authenticated and authorized operator to trigger a restart by sending specific requests, resulting in a temporary denial of service. The vulnerability affects Command Centre versions 9.50, 9.40, 9.30, 9.20, and all earlier versions.

In Coolify prior to version 4.0.0-beta.474, Sanctum API tokens did not expire, meaning a leaked token retained access indefinitely until manually revoked. This vulnerability is fixed in version 4.0.0-beta.474.

In Coolify prior to version 4.0.0-beta.474, the file upload endpoint for database backup restore did not enforce file type or size validation. This allowed an authenticated user to upload unexpected or oversized files that could affect service availability.

Coolify prior to version 4.0.0-beta.471 contains a command injection vulnerability in the DatabaseBackupJob function. An authenticated user with database management permissions can execute arbitrary commands on managed servers by manipulating database credentials or MongoDB collection exclusion names.

FOSSBilling prior to version 0.8.0 contains a vulnerability where low-privileged staff accounts can read sensitive data via admin API endpoints lacking permission checks. Write endpoints correctly enforce fine-grained permissions, but the corresponding read endpoints have no authorization guards.

In FOSSBilling versions prior to 0.8.0, the PayPalEmail payment adapter accepts PayPal IPN callbacks and credits the IPN-supplied amount (`mc_gross`) to the client's balance without validating it against the invoice total. Combined with a $0.05 floating-point epsilon tolerance in the invoice credit-payment logic, this allows a client to underpay an invoice by up to $0.04 and still have it marked as fully paid.