CVE Vulnerability Catalog

An improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability in Backup Task functionality in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users to write specific files via unspecified vectors.

Synology Hyper Backup before version 4.1.2-4036 has a path traversal vulnerability in the Backup.Repository webapi component. An authenticated administrator can write specific files containing non-sensitive information outside the allowed directory.

Cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows man-in-the-middle attackers to obtain user credentials.

Morgan, a popular Node.js logging middleware, has a log forgery vulnerability. The :remote-user token outputs the Basic Auth username without neutralizing control characters, allowing an attacker to inject forged log lines.

A use-after-free vulnerability has been detected in EIPStackGroup OpENer up to version 2.3.0 in the function CreateMessageRouterRequestStructure of the file cipmessagerouter.c in the SendRRData Handler component. Remote exploitation is possible and the exploit has been publicly disclosed.

A security vulnerability has been detected in SourceCodester Online Boat Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the component Administrative Endpoint. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Multiple endpoints are affected.

The EmergencyWP plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.4.2. Missing nonce validation in the form_settings_ui function allows unauthenticated attackers to modify plugin settings, including the minimum access role, data-erasure-on-uninstall flag, life-check timing values, mandator email address, confirmation page ID, and date/time formats.

The Passeum Ticketing plugin for WordPress up to version 1.0 is vulnerable to Stored XSS. The get_shop_url() method returns the shop_name value without sanitization when it starts with "http", and validate_shop_name() only checks for empty values and string type. Authenticated administrators can inject external scripts by setting shop_name to an attacker-controlled URL. Scripts execute on every page with the plugin shortcode.

A weakness was identified in code-index-mcp up to 2.14.0 in the is_safe_regex_pattern function of the search_code_advanced component. Manipulating the regex argument leads to inefficient regular expression complexity. Remote attack is possible and the exploit is public. Fixed in version 2.14.1.

The wonderwhy-er DesktopCommanderMCP up to version 0.2.38 has a vulnerability in src/search-manager.ts in the start_search function. Manipulating the SearchResult[] argument leads to inefficient regular expression complexity, exploitable remotely.

A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the component read_file. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 53699bebba9950047bca16ac4dc8f0568f596aaa.

LibreChat versions up to and including 0.8.3 allow users with only VIEW access to an MCP server to retrieve the server's decrypted admin-managed secrets through GET /api/mcp/servers and GET /api/mcp/servers/:serverName. The returned config includes plaintext values for apiKey.key and oauth.client_secret. This allows viewers of a shared MCP server to exfiltrate the underlying provider credentials. Version 0.8.4 contains a patch.

Functions in the net/textproto package in Go included input data as part of error messages. This allows an attacker to inject misleading content into errors that are printed or logged.

Vulnerability in alf.io before version 2.0-M5-2606: the extension sandbox injects an HTTP client (`simpleHttpClient`) into scripts. The `postFileAndSaveResponse()` method accepts arbitrary file paths without validation, allowing malicious scripts to read and exfiltrate any file to an attacker-controlled server.

A vulnerability in Go's (*x509.Certificate).VerifyHostname function causes quadratic verification cost scaling with a large DNS SAN list. An attacker can exploit this to cause a denial of service by providing a certificate with many SAN entries.

QloApps through version 1.7.0 uses the weak MD5 algorithm for password hashing in the Tools::encrypt() function. Attackers can perform offline brute-force attacks on these hashes, with the risk compounded by auto-generated 8-character passwords during guest-to-customer conversion.

In Seagate's openSeaChest version 26.03.0, the Trim/Unmap operation writes 16 bytes outside the allocated memory space when describing a range of LBAs to deallocate.

The blender-mcp plugin up to version 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b contains a code injection vulnerability in the execute_blender_code function in /src/blender_mcp/server.py. The attack can be carried out remotely and the exploit has been publicly disclosed.

A vulnerability was found in ahujasid blender-mcp up to 7636d13b. The function requests.get in src/blender_mcp/server.py of the ZIP File Handler component is vulnerable to server-side request forgery via the zip_file_url argument. The exploit has been made public.

OpenCTI versions prior to 7.260227.0 are vulnerable to XSS in the rendering of email-message observable body data. The content of the body field isn't appropriately sanitized when being rendered. Requires user interaction but could be exploited by someone sharing STIX or any of the ingester.