CVE Vulnerability Catalog

Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions, allowing scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, destroy, mass-update or mass-destroy endpoints to edit, re-send, trash or permanently delete emails and disclose their subject, body and linked lead and person data.

BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability allowing attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. A crafted bentofile.yaml or imported bento archive can cause bentoml containerize to execute injected RUN instructions during docker build, accessing build secrets and poisoning images.

Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability allowing attackers to run shell commands through improperly escaped single quotes in format_command. A file with a crafted name containing an apostrophe can cause an action like the default edit action to execute commands with victim privileges.

RisingWave before 3.1.0 contains a missing authorization vulnerability allowing low-privileged SQL users to read and write arbitrary server files by creating posix_fs sources and fs sinks. Users holding schema CREATE privilege can set posix_fs.root or fs.path to any directory to read credentials and keys or write files as root.

A vulnerability was detected in D-Link E15, M32, R15 and R32 devices in the MQTT Broker component, involving hard-coded credentials in the /etc/emDaemon/passwd file. The attack can be launched remotely and a public exploit is already available.

A security vulnerability was detected in speaches-ai speaches up to 0.9.0-rc.3 in the PyannoteDiarizationModelManager._load_fn function of src/speaches/executors/pyannote_diarization.py. Manipulating the model argument leads to use of externally-controlled input to select classes or code, enabling remote attack; the exploit is publicly disclosed.

A security flaw was discovered in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a involving missing authentication in multiple endpoints. The attack can be carried out remotely and the exploit is publicly available.

A vulnerability was identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a involving SQL injection in dodelete.php of the Registration-Delete Handler component. Manipulating the ID argument enables remote attack and the exploit is publicly available.

A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a involving SQL injection in the mysqli_query function of doedit.php in the Registration-Edit Handler component. Manipulating the id/name/title/year/gender/fromdate/todate/people arguments enables remote attack and the exploit is publicly disclosed.

In Red Hat Advanced Cluster Security for Kubernetes (RHACS), the Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity.

Deserialization of untrusted data vulnerability in the Apache Camel Camel-Jgroups component. The JGroups consumer receives messages over the default UDP multicast stack without authentication and without a deserialization filter, allowing a remote host on an adjacent network to send a crafted object and achieve remote code execution if a usable gadget chain is present on the classpath.

A vulnerability was found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578 involving SQL injection in admindocview.php of the Administrative Mutation Handler component. Manipulating the docid argument enables remote attack and the exploit is publicly disclosed.

Improper Restriction of XML External Entity Reference (XXE) vulnerability in the Smooks component (camel-smooks) of Apache Camel. The default Woodstox SAX parser resolves external entities and loads external DTDs, allowing an attacker to read local files or issue requests to internal network locations via the XML body. Affects versions from 4.7.0 before 4.18.5 and from 4.19.0 before 4.22.1.

A sensitive information exposure vulnerability in the Apache Camel HTTP component. With followRedirects=true, credentials (OAuth2 Bearer token and basic/digest credentials) were re-attached to requests sent to the host named in the redirect Location header rather than the host configured in the route. A remote endpoint could therefore collect the credentials by responding with a redirect to a host it controls.

XML External Entity (XXE) vulnerability in the Apache Camel XPath component. With documentType set to InputSource, XPathBuilder passed the payload directly to javax.xml.xpath, which built its own DocumentBuilder using JDK defaults, bypassing Camel's hardening. An external sender whose XML reached such an expression could read files readable by the Camel process and cause it to issue requests to named hosts.

A Code Injection and Expression Language Injection vulnerability in Apache Camel (versions 4.4.0–4.18.4, 4.19.0–4.22.0) affects the dynamic-router-control endpoint. DynamicRouterControlProducer took the subscription predicate and expression language name from the incoming message (body fields or CamelDynamicRouterPredicate and CamelDynamicRouterExpressionLanguage headers) and compiled them without an allow-list or opt-in. This allowed arbitrary expressions to be evaluated with the privileges of the Camel process.

The AS2 component in Apache Camel (versions 4.0.0–4.18.4 and 4.19.0–4.22.0) lets the message sender choose the asynchronous MDN notification address that Camel then connects to. This results in SSRF from the AS2 receiver's position, including reaching hosts routable only from the internal network, and configured MDN credentials may be exposed to the attacker.

The Netty HTTP component in Apache Camel (versions 4.0.0–4.18.4 and 4.19.0–4.22.0) compares the request path against the security context path case-sensitively, while routing does not. Changing the case of a path segment bypasses the security constraint and reaches the protected route without satisfying it.

A vulnerability in the Apache Camel OAuth component causes camel-oauth processors guarding a route to not stop the exchange when authentication cannot be completed. As a result, an unauthenticated caller can reach the protected endpoint as though authentication had succeeded (fail-open). This affects Apache Camel from 4.11.0 before 4.18.5 and from 4.19.0 before 4.22.1.

A path traversal vulnerability in the Apache Camel Azure Files component builds remote file paths by concatenating the configured directory with the file name from the server's directory listing, without lexical normalization or a containment check. As a result, Camel can read, delete, or rename files outside the configured polling directory using the endpoint's own credentials. The issue affects Apache Camel from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1.