CVE Vulnerability Catalog

Apache Commons Configuration from 2.2 before 2.15.0 contains an uncontrolled recursion vulnerability. Processing an untrusted YAML configuration file with cycles causes a StackOverflowError. The issue is fixed in version 2.15.0.

The WordPress plugin MapGeo – Interactive Geo Maps up to version 1.6.27 contains a Reflected XSS vulnerability via the 'map' parameter in the display-map shortcode due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can trick a user into clicking a link.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with Guest permissions to view issues in projects they were not authorized to access.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to inject HTML and JavaScript into email notifications sent to other users due to improper input sanitization.

In OpenStack Ironic versions up to 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///dev/zero URL.

Android App "あんしんフィルター for au" provided by KDDI CORPORATION contains Cleartext Transmission of Sensitive Information (CWE-319) vulnerability. A man-in-the-middle attacker may access and modify communications transmitted in plaintext, potentially resulting in information disclosure or data tampering.

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.102.0 and 16.11.0, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role.

ERPNext prior to 15.104.3 and 16.12.0 contains an improper restriction of XML external entity (XXE) reference in the EDI Module, enabling an authenticated attacker to read files from the local file system, including sensitive configuration files. Fixed in 15.104.3 and 16.12.0.

ERPNext before 15.106.0 and 16.16.0 contains a vulnerability where a malicious user can send a crafted request to an endpoint, causing the server to make an HTTP call to a service of the user's choice (SSRF).

ERPNext prior to 15.101.1 and 16.10.0 contains a Path Traversal vulnerability on an endpoint that allows an authenticated adjacent attacker to read arbitrary files. The vulnerability is fixed in 15.101.1 and 16.10.0.

Vulnerability in Angular SSR from 19.0.0-next.0 to before 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7 in X-Forwarded-Prefix header processing. The validation mechanism fails to account for URL-encoded characters, specifically dots (%2e%2e), allowing bypass of security filters via encoded path traversal sequences.

In OPNsense prior to 26.1.7, a logic flaw in lockout_handler allows an unauthenticated attacker to continuously reset the authentication failure counter for their IP address. By interjecting a crafted username containing a success keyword ("Accepted" or "Successful login") between brute-force attempts, an attacker prevents the failure counter from reaching the lockout threshold. The vulnerability is fixed in 26.1.7.

Vulnerability in the ftpcp() function in Python's ftplib.py module. This function was not updated when CVE-2021-4189 was fixed, allowing an attacker to control the IP address and port passed to target.sendport().

Quark Drive before version 0.8.5 contains a stored cross-site scripting vulnerability in the System Configuration page. The template renders push_config key names using Vue.js's v-html directive without escaping, allowing authenticated attackers to inject HTML or JavaScript payloads via the POST /update endpoint. The injected payload is persisted to disk and executed in the browsers of all authenticated users accessing the System Configuration tab.

In MISP, prior to version 2.5.37, a SQL injection vulnerability existed in the handling of user-controlled ordering parameters in the event and shadow attribute listing endpoints. An attacker could craft a malicious ordering parameter to manipulate the generated SQL query.

MISP is an open source threat intelligence and sharing platform. Prior to version 2.5.37, MISP Collections did not enforce RFC 4122 UUID validation, allowing users to submit malformed UUID values, potentially leading to data integrity issues.

CubeCart to rozwiązanie oprogramowania e-commerce. Przed wersją 6.7.0 występuje podatność na Reflected XSS w funkcji wyszukiwania, która pozwala na odzwierciedlenie nieautoryzowanego wejścia użytkownika bez sanitizacji, gdy wyszukiwanie zwraca dokładnie jeden produkt.

Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could bypass a proxy route rule by sending percent-encoded path traversal (..%2f) in the URL, causing Nitro to forward a request that the upstream resolved outside the configured scope.

Nitro prior to 3.0.260429-beta allows an attacker to turn a wildcard redirect route rule into a cross-host redirect by sliding an extra slash after the rule prefix. This vulnerability is fixed in 3.0.260429-beta.

In PyQuorum prior to 0.2.1, the mul_mod function implements multiplication via a binary expansion loop whose execution time depends on the Hamming weight of the second operand (the exponent). An attacker able to measure the time of secret-sharing operations (e.g., via a remote service) could progressively recover share values, ultimately leading to secret reconstruction. The vulnerability is fixed in 0.2.1.