CVE Vulnerability Catalog

The DeepL Chrome browser extension versions from v1.22.0 to v1.23.0 contain a cross-site scripting vulnerability, allowing an attacker to execute arbitrary scripts in a user's browser and inject malicious HTML into web pages viewed by the user.

The a+HCM product developed by aEnrich has an arbitrary file upload vulnerability, allowing unauthenticated remote attackers to upload arbitrary files to any path, including HTML documents.

The a+HRD developed by aEnrich has a Missing Authorization vulnerability, allowing authenticated remote attackers to arbitrarily read database contents through a specific API method.

The a+HRD developed by aEnrich has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.

OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and filter handling. Attackers can inject arbitrary SQL expressions via the query= and filter= parameters for integer-mapped DAAP fields.

free5GC AMF prior to version 1.4.3 has a flaw in the HTTPUEContextTransfer handler where the missing default case in the Content-Type switch causes deserialization to be skipped and the processor invoked with an uninitialized UeContextTransferRequest object. This can lead to unexpected behavior or crashes. Version 1.4.3 contains a fix.

Craft CMS is a content management system. In versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9.14, the resource-js endpoint allows unauthenticated requests to proxy remote JavaScript resources. When trustedHosts is not explicitly restricted, the application trusts the client-supplied Host header, allowing an attacker to control the derived baseUrl and leading to SSRF.

Craft CMS versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9.14 are vulnerable to Server-Side Request Forgery. Exploitation requires the GraphQL schema permissions 'Edit assets in the <VolumeName> volume' and 'Create assets in the <VolumeName> volume' to be enabled. Versions 4.17.9 and 5.9.15 patch the issue.

Craft CMS is a content management system. In versions 5.6.0 through 5.9.14, the actionSavePermissions() endpoint allows a user with only viewUsers permission to remove arbitrary users from all user groups. While _saveUserGroups() enforces per-group authorization for additions, it performs no equivalent check for removals, so submitting an empty groups value removes all existing group memberships. Version 5.9.15 contains a patch.

In free5GC UDR up to and including 1.4.2, a fail-open request handling flaw causes the /nudr-dr/v2/policy-data/subs-to-notify POST handler to continue processing requests even after request body retrieval or deserialization errors. This may allow unintended creation of Policy Data notification subscriptions with invalid, empty, or partially processed input.

An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to determine the names of private repositories by their numeric ID. The mobile upload policy API endpoint did not perform an early authorization check, and validation error messages included the full repository name for repositories the caller did not have access to. This affected all versions prior to 3.21 and was fixed in 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26.

AVideo versions 29.0 and below contain an incomplete XSS fix in the ParsedownSafeWithLinks class that overrides inlineMarkup for raw HTML but does not override inlineLink() or inlineUrlTag(). This allows javascript: URLs in markdown link syntax to bypass sanitization. Commit cae8f0dadbdd962c89b91d0095c76edb8aadcacf contains an updated fix.

WWBN AVideo versions 29.0 and below contain a bypass of the directory traversal fix in objects/aVideoEncoderReceiveImage.json.php. The fix only checks the URL path for '..' sequences, while try_get_contents_from_local() uses explode('/videos/', $url) on the full URL string including the query string, allowing an attacker to place a /videos/../../ payload in the query string and read arbitrary files from the server filesystem.

WWBN AVideo versions 29.0 and below have an isValidDuration() regex without an end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duration is stored in the database and rendered without HTML escaping on trending pages, playlist pages, and video gallery thumbnails, resulting in stored XSS.

AVideo versions 29.0 and prior allow any unauthenticated client to force the server to generate a 1-character CAPTCHA word via the ql parameter in objects/getCaptcha.php without clamping or sanitization. Combined with a case-insensitive strcasecmp comparison over a ~33-character alphabet and the fact that failed validations do NOT consume the stored session token, an attacker can trivially brute-force the CAPTCHA on any endpoint in at most ~33 requests per session. Commit bf1c76989e6a9054be4f0eb009d68f0f2464b453 contains a fix.

In AVideo versions 29.0 and prior, the objects/commentDelete.json.php endpoint deletes comments without CSRF validation, not checking a token or Origin/Referer headers. Because the session cookie uses SameSite=None, an attacker-controlled page can automatically send a request with the victim's session and force mass comment deletion.

AVideo versions 29.0 and prior contain multiple JSON endpoints under objects/ that accept state-changing requests via $_REQUEST/$_GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious page visited by a logged-in victim can silently cast/flip the victim's like/dislike on a comment, post a comment authored by the victim on any video, and/or delete assets from any category.

nesquena hermes-webui contains a trust-boundary failure vulnerability that allows authenticated attackers to set or change a session workspace to an arbitrary existing directory on disk by manipulating workspace path parameters in endpoints such as /api/session/new, /api/session/update, /api/chat/start, and /api/workspaces/add.

A security flaw was discovered in Comfast CF-N1-S version 2.6.0.1 affecting unknown functionality of /cgi-bin/mbox-config?method=SET&section=ping_config within the Endpoint component. Manipulation of the destination argument results in command injection, and the attack can be initiated remotely. The exploit has been released to the public and may be used for attacks; the vendor did not respond.

KDE Kleopatra before 26.08.0 on Windows allows local users to obtain the privileges of a Kleopatra user due to an error in the KUniqueService mechanism that ensures only one instance runs.