CVE Vulnerability Catalog

OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When require_request_header is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down these services.

OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key used for TLS listener certificates, letting them bind to the operator's ACME account.

OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid until the periodic tidy removes them. An attacker holding an expired, untidied Secret ID can log in and gain access beyond its TTL.

OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded certificates, so quota rules scoped to backend-specific roles are not enforced. Valid callers can repeatedly issue tokens without consuming the configured role-based rate limit budget.

OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can submit requests with malformed TypeKVPair or TypeHeader field values, causing error messages containing sensitive input to be recorded in audit logs.

OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker using these endpoints can complete root token generation or rekey operations without a corresponding response audit record, hindering forensic detection.

On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, a user granted subscription-creation permissions may be able to query and read resources they are not otherwise permitted to access. The flaw stems from insufficient authorization checks on subscriptions.

Supabase Realtime prior to version 2.103.1 accepts an expired JWT on REST broadcast endpoints when the exp claim is encoded as a JSON string instead of a number. This allows an unauthenticated attacker to broadcast realtime messages to subscribers.

In subhajitkhan online-clinic-management-system up to commit e9ee77a, patdocmsg.php is vulnerable to cross-site scripting via manipulation of the Query argument. The attack can be performed remotely and a public exploit is available.

fzf versions 0.36.0 through 0.74.5 contain an inefficient algorithmic complexity vulnerability in maskActionContents that lets local attackers exhaust the --listen HTTP server via quadratic string concatenation. Repeatedly sending ~1 MB POST bodies to the unauthenticated localhost port blocks the single-threaded server for about 30 seconds each time.

HCL AppScan Azure Boards Plugin is affected by a Cleartext Transmission of Sensitive Information vulnerability when configured to communicate with the AppScan server over HTTP. This could allow an attacker to intercept credentials or authentication tokens during transmission. The plugin has been updated to display a warning when HTTP is used and recommend HTTPS for secure communication.

The HCL AppScan Azure Boards Plugin may expose secrets in plaintext during pipeline execution. Depending on pipeline configuration, secrets could be visible in task outputs, debug logs, environment variable dumps, or build agent scripts despite UI masking.

A flaw was found in mod_qos where improper boundary checking when inspecting HTTP response bodies causes the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this by triggering specially crafted server responses, crashing an Apache worker process and causing a Denial of Service (DoS).

A flaw was found in mod_qos that allows an unauthenticated remote attacker to cause a Denial of Service (DoS) by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during processing of percent-encoded input, the module reads past allocated memory boundaries, which can crash an Apache worker process.

The MasterStudy LMS WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor. This allows users with the Instructor role to overwrite the first name, last name, and public display name of any registered user, including administrators, enabling impersonation and phishing.

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capability check in its export feature. This allows users with a role as low as Contributor to read the configuration of admin-only custom post types and taxonomies, as well as the titles, dates, statuses and some stored content of other users' non-public posts and pages.

The Infility Global WordPress plugin before version 2.16.25 does not perform any authorization or nonce check on an AJAX action available to unauthenticated users. This allows any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before version 2.16.25.

The Drupal AI CKEditor module contains a code injection vulnerability due to improper neutralization of special elements used in a template engine. This issue affects AI CKEditor versions from 0.0.0 to 1.4.3.

The Drupal Stop administrator login module contains an authentication bypass using an alternate path or channel. This issue affects Stop administrator login versions from 1.0 to 1.6.

The Drupal Mermaid Diagram Field module contains an incorrect authorization vulnerability allowing forceful browsing. This issue affects Mermaid Diagram Field versions from 1.0.4 to 1.0.9.