CVE Vulnerability Catalog

Mattermost Mobile Apps versions up to 2.37 11.4 2.0.37 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to properly validate the SSO authentication callback origin, allowing an attacker controlling a malicious Mattermost server to steal user credentials for a legitimate Mattermost server via relaying the SSO code exchange flow through the mobile application.

Mattermost versions 11.5.x <= 11.5.1 fail to validate team-level run_create permission against the target team when creating a playbook run, allowing an authenticated team member to create runs in teams where they lack permission by specifying a different team ID in the API request.

Insufficient sanitization of volume paths in Netatalk 3.1.0 through 4.4.2 allows a local privileged user to inject OS commands and execute arbitrary code via a crafted volume path.

Authentication modules in Netatalk 1.5.0 through 4.4.2 fail to check the return value of seteuid(), which may allow a remote authenticated attacker to retain elevated privileges under error conditions.

Netatalk versions 2.1.0 through 4.4.2 contain a heap over-read vulnerability in extended attribute (EA) header parsing. A remote authenticated attacker can use crafted EA data to obtain limited information or cause minor service disruption.

An off-by-two error in lp_write() in papd in Netatalk 2.0.0 through 4.4.2 allows an adjacent network attacker to modify limited data or cause a minor service disruption via crafted print data.

Netatalk versions 2.1.0 through 4.4.2 contain an LDAP injection vulnerability. A remote authenticated attacker can manipulate LDAP queries, obtaining limited information or modifying LDAP entries via crafted filter input.

A vulnerability in Netatalk versions 1.5.0 through 4.4.2 uses DES-ECB for authentication with a timing side channel, allowing a remote attacker to recover authentication credentials via timing analysis.

A race condition in the privilege toggle mechanism in Netatalk 2.2.5 through 4.4.2 allows a local attacker to obtain limited information, modify limited data, or cause minor service disruption.

A stack-based buffer overflow in desktop.c in Netatalk versions 1.3 through 4.2.2 allows a remote authenticated attacker to cause a denial of service, obtain limited information, or modify limited data.

Netatalk 2.0.0 through 4.4.2 generates AFP session tokens derived from predictable process IDs, which allows a remote authenticated attacker to cause a denial of service by exploiting the reconnect mechanism.

In mlflow/mlflow up to version 3.9.0, the SearchModelVersions REST API and GraphQL endpoints lack proper authorization checks, allowing any authenticated user to enumerate all model versions. Fixed in version 3.10.0.

The Avada (Fusion) Builder plugin for WordPress up to version 3.15.2 is vulnerable to stored XSS via multiple shortcodes due to insufficient input sanitization and output escaping.

The WPB Floating Menu & Categories for WordPress plugin up to version 1.0.8 has a Stored Cross-Site Scripting vulnerability in the 'Icon CSS Class' category field. Authenticated attackers with Editor-level access or above can inject arbitrary scripts that execute when users view the page.

The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.52.2 via the get_sponsored_meta AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disclose any private post metadata.

A heap buffer overflow vulnerability has been found in the libsolv library when processing a specially crafted .solv file with negative size values in the repo_add_solv function. This leads to undersized memory allocation and out-of-bounds write, which can be exploited for a DoS attack.

In libsolv, a stack-based buffer overflow vulnerability exists in the Debian metadata parser when processing specially crafted Debian repository metadata. An attacker can provide malicious SHA384 or SHA512 checksum tags, leading to memory corruption and denial of service (DoS).

In Plane (project management tool) versions 1.3.0 and below, the SavedAnalyticEndpoint passes user-controlled segment parameter directly to a Django F() expression without validation, causing ORM Field Reference Injection. An authenticated workspace member can read sensitive data such as bcrypt password hashes, API tokens, and email addresses.

In the nimiq-blockchain library (versions 1.3.0 and prior), network discovery accepts signed PeerContact updates from untrusted peers and stores them in the contact book, potentially causing an address book crash. An attacker can send a contact with an empty address list, causing a panic when accessing the address book.

Mantis Bug Tracker (MantisBT) up to version 2.28.1 is vulnerable to HTML and JavaScript injection in a textarea custom field on the Update Issue page. An authenticated attacker with low privileges can inject code that executes in the administrator's browser, leading to session theft and account takeover.