CVE Vulnerability Catalog

A path traversal vulnerability in the Apache Camel SMB component allows reading, deleting, or renaming files outside the configured remote directory. This is due to missing normalization and containment checks when concatenating the directory with a file name from the server's listing. The issue affects Apache Camel versions from 4.2.0 before 4.18.5 and from 4.19.0 before 4.22.1.

A path traversal vulnerability in the Apache Camel Mina SFTP component allows escaping the configured remote directory when retrieving, deleting, or renaming files. The file name from the server listing is not normalized or checked for containment within the directory, enabling an on-path attacker or malicious server to supply a name with parent-directory segments. The issue affects Apache Camel versions from 4.18.0 before 4.18.5 and from 4.19.0 before 4.22.1.

A path traversal vulnerability in the Apache Camel FTP component allows reading, deleting, or renaming files outside the configured remote directory. This is due to missing normalization and containment checks when concatenating the directory with the file name from the server's listing. It affects versions 4.0.0–4.18.4, 4.19.0–4.22.0, and the ftp, ftps, and sftp schemes.

Deserialization of untrusted data vulnerability in the Apache Camel Spring Redis component. When no serializer was configured, the component defaulted to JdkSerializationRedisSerializer without an ObjectInputFilter, allowing code execution via crafted data in Redis. Affects versions from 2.11.0 before 4.18.5 and from 4.19.0 before 4.22.1.

A vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components allows an inbound message sender to override the endpoint URI via the CamelHttpUri and CamelRestHttpUri headers, after which property placeholders in that string are resolved (environment variables, system properties, secret functions, bean invocations). This can lead to exposure of sensitive information and unexpected bean method invocation. The issue affects Apache Camel from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1.

A flaw was found in eremef bandcamp-player up to 1.8.33-beta in an unknown function of database.ts in the Remote Control Server component. Manipulating the remoteEnabled argument can lead to missing authentication, and the attack may be launched remotely. Upgrading to 1.8.34-beta resolves the issue.

In Apache Answer through 2.0.2, full API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials.

MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. When a branch name (such as Security, MISP, or Plugin) is supplied instead of a specific leaf setting, the function returns the entire sub-tree, bypassing the redaction check. This exposes sensitive values including the security salt, Redis connection passwords, and plugin API keys; affects versions <2.5.48.

A deserialization of untrusted data vulnerability in the ExpressTech Quiz And Survey Master (quiz-master-next) plugin allows object injection. This issue affects Quiz And Survey Master from n/a through 11.2.7.

The MapSVG plugin for WordPress (versions up to 8.16.1) contains a Path Traversal vulnerability due to improper limitation of a pathname to a restricted directory. This may allow an attacker to access files outside the intended directory.

The Quiz Maker plugin by Ays Pro (versions up to 6.7.1.91) contains a Reflected Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This may allow an attacker to inject malicious script.

A path-confinement bypass vulnerability in Apache Kylin during metadata backup deletion. It affects versions 4.0.0 through 5.0.4 and impacts mainly services directly exposed to the public network.

The Integratec application contains a UNION-based SQL injection vulnerability in the sInfo parameter sent via POST to the endpoint /login/ap_Login.aspx/start. Successful exploitation could allow an attacker to steal data from the database, such as credentials and user information, and cause errors and partial denial-of-service conditions.

MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes. This could lead to unauthorized disclosure of proposed attribute changes.

MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the bin/cygwin1.dll library contained within it with a malicious library. When the victim opens a Local Shell session or uses a Cygwin-based function, the application extracts the component and loads the tampered library, executing code with the victim's permissions.

VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may cause the product to initiate unintended communication, potentially leading to the leak of sensitive information from the device where the product is installed or resulting in a denial-of-service (DoS) condition.

A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC.

A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.

A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

A path traversal vulnerability exists in the View Logs functionality of koozali's SME Server version 11.0rc1-215. An unauthenticated attacker can access files outside the intended directory, leading to exfiltration of potentially sensitive system and application files.