CVE Vulnerability Catalog

OrangeHRM Open Source versions 5.0 through 5.8 omit authorization on job specification and vacancy attachment download handlers. Authenticated low-privilege users can read attachments via direct reference to attachment identifiers.

OrangeHRM Open Source from 5.0 to 5.8 allowed authenticated users to bypass disabled-module access controls via URL-encoded request paths and access functionality of modules disabled by an administrator. Fixed in 5.8.1.

OrangeHRM Open Source versions 5.0 to 5.8 fail to restrict email template file resolution to the intended plugins directory, allowing an authenticated attacker who can influence the template path to read arbitrary local files. This is fixed in version 5.8.1.

Improper neutralization of alternate XSS syntax vulnerability in The Wikimedia Foundation Mediawiki - Wikilove Extension allows Cross-Site Scripting (XSS). The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.

In ChurchCRM prior to 7.1.0, a Blind Reflected Cross-Site Scripting vulnerability exists in the search parameter accepted by the ChurchCRM dashboard. The application fails to sanitize or encode user-supplied input before rendering it in the browser's DOM; although an HTTP 500 error is ultimately returned, the browser's JavaScript engine parses and executes the injected <script> tags before the error response is returned.

In ChurchCRM before 7.1.0, a stored XSS issue affects Directory Reports form fields set from config, Person editor defaults rendered into address fields, and external self-registration form defaults. This is primarily an admin-to-admin stored XSS path abusing writable configuration fields.

ChurchCRM prior to 7.1.1 contains Stored XSS in group remove control and family editor state/country. This is primarily an admin-to-admin stored XSS path when writable entity fields are abused.

ChurchCRM is an open-source church management system. Prior to 6.5.3, it is possible to trigger server-side HTTP/HTTPS requests to arbitrary hosts (SSRF) by supplying a crafted URL in the Referer request header; the server then makes an outbound request to the attacker-controlled domain (confirmed via OAST); this is fixed in 6.5.3.

NVIDIA Triton Inference Server contains a vulnerability where an attacker may cause information disclosure by uploading a model configuration. A successful exploit may lead to information disclosure or denial of service.

OpenViking versions prior to 0.3.3 have a missing authorization vulnerability in task polling endpoints. Unauthenticated attackers can enumerate or retrieve background task metadata created by other users, including task type, status, resource identifiers, archive URIs, result payloads, and error information.

OpenPrinting CUPS versions 2.4.16 and prior contain a use-after-free vulnerability in the cupsd scheduler when temporary printers are automatically deleted. cupsdDeleteTemporaryPrinters() calls cupsdDeletePrinter() without first expiring subscriptions referencing the printer, leaving a dangling pointer that is later dereferenced.

OpenPrinting CUPS versions 2.4.16 and prior contain an integer underflow in _ppdCreateFromIPP() (cups/ppd-cache.c). Any unprivileged local user can crash the root cupsd process by supplying a negative job-password-supported IPP attribute. The value passes validation, is cast to size_t (wrapping to ~2^64), and is used as the length argument to memset() on a 33-byte stack buffer, causing an immediate SIGSEGV. Combined with systemd's Restart=on-failure, an attacker can repeat the crash for sustained denial of service.

coursevault-preview versions prior to 0.1.1 contain a path traversal vulnerability in the resolveSafe utility. The boundary check used String.prototype.startsWith(baseDir) on a normalized path, which does not enforce a directory boundary. An attacker who controls the relativePath argument may read files outside the configured baseDir when a sibling directory exists whose name shares the same string prefix. This is fixed in 0.1.1.

QuickDrop before version 1.5.3 has a stored XSS vulnerability in the file preview endpoint. The application allows SVG file uploads via /api/file/upload-chunk, and a malicious SVG with JavaScript payload executes in the application's domain context when previewed. The vulnerability is fixed in 1.5.3.

Emissary before 8.39.0 validates configuration names in the /api/configuration/{name} endpoint using a blacklist checking for \, /, .., and trailing ... This can be bypassed using URL-encoded variants, double-encoding, or Unicode normalization to achieve path traversal and read configuration files outside the intended directory. Fixed in 8.39.0.

Apache Cassandra 4.0, 4.1, and 5.0 allow an authenticated user to raise query latencies via repeated password changes (authenticated DoS over CQL). The issue is fixed in versions 4.0.20, 4.1.11, and 5.0.7.

Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from previously executed cqlsh commands via the ~/.cassandra/cqlsh_history local file. Anyone with access to this file can read the cleartext credentials.

yaffa v2.0.0 is vulnerable to cross-site scripting (XSS): an attacker can inject malicious JavaScript into the "Add Account Group" function on the account-group page, executing arbitrary script in the context of users viewing the page.

The Backup Migration plugin for WordPress up to version 2.0.0 has a missing authorization in the initializeOfflineAjax function and lacks nonce verification. The endpoint only validates hardcoded tokens publicly exposed in the plugin's JavaScript, allowing unauthenticated attackers to trigger backup upload queue processing, potentially causing unexpected transfers to configured cloud storage targets and resource exhaustion.

Libarchive has a NULL pointer dereference vulnerability in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare 'd' or 'default' tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash.