CVE Vulnerability Catalog

In Coop before 1.0.2, addAccessibleQueuesForUser and removeAccessibleQueuesForUser accepted arbitrary queueId and userId values without organization scoping. An authenticated user belonging to one organization and holding MRT queue-edit permission could grant or revoke another organization's users' access to manual review queues. The existing queue-edit permission check did not bind the supplied identifiers to the caller's organization. The attacker could not read the other organization's queues or jobs, so this issue did not disclose confidential data.

In Coop before 1.0.0, the GraphQL Mutation.createOrg operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting could potentially lead to database exhaustion. Running the service on an authenticated private network prevents outside actors from directly querying the GraphQL API.

In sevenz-rust2 before 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In src/util/decompress.rs, decompress_impl computes each destination with dest.join(entry.name()) without normalizing the archive's UTF-16 entry name or verifying containment, and default_entry_extract_fn writes to it with File::create. Parent-directory components escape the extraction root, and an absolute entry path makes the join discard the destination entirely. The convenience entry points decompress, decompress_file, decompress_with_password, and decompress_file_with_password all use this default path. Overwriting writable configuration, startup, cron, or build files can lead to code execution or persistence.

In Kubewarden policies before version 2.1.2, the trusted-repos-policy compares an image's registry hostname against reject and allow lists case-sensitively even though registry DNS names are case-insensitive. An image with an uppercase or mixed-case registry hostname can miss a rejection rule for the equivalent lowercase host, so the admission policy accepts a resource whose container runtime pulls the same prohibited image.

In ActivityPub for Ghost from 1.0.0 until 1.2.6, the Undo handler allows a remote federated server to cause the service to act on a follow or repost as though the activity came from a different account. This permits removal of an existing follow relationship or repost belonging to another account without that account's involvement.

The standalone Element Call SPA (from 0.16.0 until 0.20.3) logs the `password` URL query parameter. When a user submits an error report (rageshake), these logs are shared with the application operator, potentially disclosing the shared password used to encrypt the call.

In LubeLogger prior to 1.6.8, `PrintRecordStickers` verifies access to the supplied `vehicleId` but fetches caller-supplied `recordIds` without checking that each record belongs to the authorized vehicle. An authenticated user can thus retrieve other users' records across multiple modules.

In unpatched uhttpd repository snapshots, `client_parse_header()` compares the `Transfer-Encoding` value to `chunked` case-sensitively, although transfer-coding tokens are case-insensitive. A mixed-case token is accepted without enabling chunked handling, allowing HTTP request smuggling on keep-alive connections.

In unpatched uhttpd repository snapshots, `uh_ubus_data_send()` can desynchronize HTTP request boundaries when a `POST /ubus` JSON body arrives in multiple TCP segments. The unread body suffix is then processed as a new request on the same keep-alive connection.

In LORIS versions from 22.0.0 before 27.0.4 and from 28.0.0 before 28.0.2, the `imaging_browser` module API permits edits to imaging data without checking the frontend edit permissions. An authenticated API caller can modify imaging data without the required edit authorization.

In LORIS versions from 16.0.0 before 27.0.4 and from 28.0.0 before 28.0.2, the `issue_tracker` backend does not correctly verify edit access permissions, although the frontend restricts which issues a user may edit. An authenticated user can submit backend changes to issues outside their permitted edit scope.

Shopper is a headless e-commerce admin panel. Prior to 2.10.1, the customer detail route /cpanel/customers/{user}/show checks read_customers but looks up an arbitrary user ID without applying the customers role scope used by the listing. Authenticated staff holding access_dashboard and read_customers can change the user ID to retrieve administrator or staff profiles despite lacking view_users. The flaw exposes account profile data and permits user-ID enumeration; combined with delete_customers, it can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1.

Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the /api/auth/login endpoint reveals whether a username exists through a timing discrepancy: AuthController.login() throws BadCredentialsException immediately for an unknown username, before passwordEncoder.matches(...), whereas an existing username with an incorrect password incurs the bcrypt comparison cost. Both cases return the same generic HTTP 401 response, but repeated latency measurements disclose valid usernames without credentials. This issue is fixed in release 1.0.8.

Filecoin Pin up to and including version 1.1.0 does not enforce request rate limits or per-user quotas on POST /pins, and each pin is processed in the background without a queue or concurrency cap. Missing byte, block and traversal-time limits allow an authenticated caller, or an anonymous caller when ALLOW_NO_AUTH=true, to exhaust disk, network, CPU, memory and libp2p resources, causing service degradation or host/process failure and leaving partial CAR files requiring recovery.

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger algorithmic resource exhaustion in decode_R13_R2000 in src/decode.c. The class-decoding loop performs realloc on every iteration without a sanity check on num_classes; manipulating that field forces an extremely slow allocation loop and denial of service when the file is parsed. Running the parser in a sandbox with memory limits is a workaround rather than a remediation. This issue is fixed in version 0.14.

LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make decode_preR13_entities() in src/decode.c enter a nonterminating loop that allocates a new object each iteration. decode_preR13 in src/decode_r11.c computes size from the raw file-controlled entities_start and entities_end header bounds; the callee clamps end to dat->size but never recalculates size. At end of input, bit_read_RC and bit_read_RS stop advancing dat->byte, the overflow guard fails, and the no-advance check compares against oldpos saved before the loop. This leaves repeated allocation of dwg->object entries until allocation fails or the process is OOM-killed. The defect is fixed in version 0.14.8413.

Picotls is a TLS protocol library that allows users to select different crypto backends. In affected revisions through 44bc503, when picotls is used as a client-side TLS stack, a peer can send a HelloRetryRequest followed by a spoofed Hello message that causes a null-pointer dereference. This can terminate the consuming process, including a process performing other work, resulting in denial of service. This issue is fixed in commit a06ca41.

In Stirling-PDF prior to 3.0.0, the POST /api/v1/ai/tools/create-pdf-from-html-agent endpoint accepts attacker-controlled htmlContent and passes it to WeasyPrint without CustomHtmlSanitizer, unlike the sanitized /api/v1/convert/html/pdf control path. HTTP and HTTPS resource references can make server-side requests to internal or cloud-metadata destinations, while file references can embed local content readable by the Stirling-PDF process into the generated PDF. The endpoint is reachable without credentials when security.enableLogin is false.

In Stirling-PDF from 2.13.1 until 2.13.2, the POST /api/v1/convert/svg/pdf endpoint renders attacker-supplied SVG through Apache Batik, and a scheme-less root-relative image reference bypasses SvgSanitizer.isExternalUrl() before Batik resolves it against the file:///input.svg document base as a same-origin local file. The convert() and addSvgAsPage() paths in SvgToPdf.java can then render image-decodable server files into the returned PDF when sanitization is enabled, including without authentication on login-disabled deployments or with non-admin access when login is enabled. The issue discloses PNG, JPG, GIF, or SVG content and provides an existence oracle only for image-decodable paths.

In Tesseract prior to 5.5.4, GENERIC_2D_ARRAY::DeSerializeSize in src/ccstruct/matrix.h reads matrix dimensions as signed int32_t values and compares them only with UINT16_MAX, allowing negative values to reach ResizeNoInit. Negative dimensions or a 65535 by 65535 product can create inconsistent allocation state and later out-of-bounds accesses while loading a crafted traineddata file, causing denial of service.