CVE Vulnerability Catalog

A vulnerability in TransformerOptimus SuperAGI up to 0.0.14 affects the update_organisation function in superagi/controllers/organisation.py (Organisation Update Endpoint). Manipulation of the organisation_id argument causes authorization bypass. The exploit has been publicly disclosed and may be used remotely; the vendor did not respond.

A vulnerability in TransformerOptimus SuperAGI up to 0.0.14 affects the update_user function in superagi/controllers/user.py (User Update Endpoint). Manipulation of the user_id argument results in authorization bypass. The exploit has been made public and could be used remotely; the vendor did not respond.

A vulnerability in TransformerOptimus SuperAGI up to 0.0.14 affects the delete_api_key/edit_api_key functions in superagi/controllers/api_key.py (API Key Management Endpoint). Manipulation leads to authorization bypass. The exploit has been disclosed to the public and may be used remotely; the vendor did not respond.

A weakness was identified in liangliangyy DjangoBlog up to 2.1.0.0 affecting an unknown function in blog/views.py of the Clean Endpoint component, causing missing authentication. The attack may be initiated remotely, and a public exploit could be used. The vendor was contacted but did not respond.

A security flaw was discovered in DjangoBlog up to version 2.1.0.0 affecting djangoblog/settings.py, where a hard-coded SECRET_KEY is used. The attack can be launched remotely but requires high complexity. The exploit has been publicly released and the vendor did not respond.

A vulnerability was determined in liangliangyy DjangoBlog up to 2.1.0.0 in the CommandHandler function of servermanager/api/commonapi.py within the WeChat Bot Interface component. Manipulation of the Source argument leads to command injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be utilized; the vendor was contacted but did not respond.

A vulnerability was detected in Collabora KodExplorer up to 4.52 in /app/controller/share.class.php (fileUpload endpoint) due to improper authorization when manipulating the fileUpload argument. Remote exploitation is possible but requires high complexity. The exploit has been publicly disclosed and the vendor did not respond.

A weakness has been identified in kodcloud KodExplorer up to 4.52. Affected by this vulnerability is the function roleGroupAction of the file /app/controller/systemRole.class.php. Executing a manipulation of the argument group_role can lead to authorization bypass. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

A vulnerability was found in EMQ EMQX Enterprise up to 6.1.0 in the Session Handling component. Manipulation results in improper authorization. The attack can be launched remotely and the exploit has been made public.

A weakness was identified in Wavlink WL-WN579A3 220323 affecting the sub_401F80 function in /cgi-bin/login.cgi. Manipulation of the Hostname argument causes cross-site scripting, exploitable remotely. The vendor quickly released a fixed version of the product.

The Keycloak authentication manager in apache-airflow-providers-keycloak did not generate or validate the OAuth 2.0 state parameter on the login/login-callback flow and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's browser and cause the victim to be logged into the attacker's Airflow session (login-CSRF / session fixation).

W wersji 2.18 biblioteki Little CMS (lcms2) występuje przepełnienie całkowite w funkcji CubeSize w pliku cmslut.c, ponieważ sprawdzenie przepełnienia jest wykonywane po mnożeniu.

gdown versions prior to 5.2.2 are vulnerable to a path traversal attack in the extractall functionality when extracting maliciously crafted ZIP or TAR archives. Filenames are not sanitized, allowing files to be written outside the intended directory.

ChurchCRM versions prior to 7.2.0 render stored usernames directly into an HTML input value attribute in UserEditor.php without htmlspecialchars(). An administrator can save a username containing HTML attribute-breaking characters and event handlers that execute in the browser of any administrator viewing that user's editor page, resulting in stored XSS. The issue is fixed in version 7.2.0.

In ChurchCRM versions prior to 7.2.0, the public API login endpoint (/api/public/user/login) returns distinguishable HTTP response codes based on whether a username exists: 404 for non-existent users and 401 for valid users with incorrect passwords. An unauthenticated attacker can exploit this difference to enumerate valid usernames, with no rate limiting or account lockout to impede the process.

ChurchCRM versions prior to 7.2.0 contain a stored XSS vulnerability in the Pledge Editor, which renders donation comment values directly into HTML input value attributes without escaping via htmlspecialchars(). An authenticated user with Finance permissions can inject HTML attribute-breaking characters and event handlers that are stored in the database and execute in the browser of any user opening the pledge record.

Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted multipart/form-data requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later.

NocoBase prior to version 2.0.37 — the workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-provided URLs without any SSRF protection. An authenticated user can access internal network services, cloud metadata endpoints, and localhost.

libgphoto2 versions up to and including 2.5.33 have an out-of-bounds read vulnerability in ptp_unpack_OI() in camlibs/ptp2/ptp-pack.c (lines 530–563). The function validates len < PTP_oi_SequenceNumber (i.e., len < 48) but subsequently accesses offsets 48–56, up to 9 bytes beyond the validated boundary, via the Samsung Galaxy 64-bit objectsize detection heuristic. Commit 7c7f515bc88c3d0c4098ac965d313518e0ccbe33 fixes the issue.

libgphoto2 versions up to and including 2.5.33 have an out-of-bounds read in ptp_unpack_Sony_DPD() in camlibs/ptp2/ptp-pack.c. The function reads the FormFlag byte without a prior bounds check, unlike the standard ptp_unpack_DPD() which performs this validation.