CVE Vulnerability Catalog

Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh and jcp.sh subcommands that allows jailed users to escape jail isolation. An attacker inside a jail can plant symlinks pointing to host paths or other jail roots, so administrator-run copies overwrite or read host files with root privileges.

xiaozhi-esp32-server through 0.9.8 contains an authentication bypass in WebSocketServer._handle_auth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. An attacker supplying an allowlisted MAC-address-shaped device identifier can open an authenticated WebSocket session, issue voice-assistant commands, exchange audio and read that device's conversation context.

WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. An attacker can attach comments to draft, private, trashed or password-protected posts to leak hidden titles via moderator notifications, enumerate post IDs and backdate comments or mark them as pingbacks.

WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. An attacker can send one HTTP request with many aliases, bypassing batch_limit, to exhaust mail provider quota and repeatedly rotate reset keys, blocking legitimate password recovery.

WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. An attacker can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types and unapproved comments.

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. An attacker can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.

The JetFormBuilder plugin (Crocoblock) through 3.6.7.1 contains a Basic XSS vulnerability due to improper neutralization of script-related HTML tags. This can lead to code injection in the page context.

The Events Calendar plugin (Liquid Web / StellarWP) through 6.18.2 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed for users viewing the page.

Prior to 1.4.0, @zuke/cli inspects scaffold names with lstat but then performs link-following reads, writes, and permission changes in zuke setup and zuke import. An attacker supplying an untrusted cloned repository, template, or archive with a symbolic link at a scaffolded name can cause setup to overwrite a target outside the selected directory with the invoking user's permissions. The issue is fixed in version 1.4.0.

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values. A GitHub Actions build that places secret-derived text in a summary note can publish credentials in cleartext to everyone able to view the workflow run.

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWorkflow(...) gate correlates a dispatched workflow run using only a display-title marker that is visible in the workflow run list and can be copied by another dispatcher. In configurations where the external workflow repository grants workflow_dispatch permission to a party not equally trusted by the releasing repository, an attacker can dispatch a run with the marker and cause the gate to adopt its conclusion without verifying the event, ref, or creation window.

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool from node_modules/.bin and passes attacker-influenced text containing an unquoted &, |, or ^ metacharacter can execute an additional attacker-chosen command in the build's context with access to its credentials.

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKE_REGISTRY_LAUNCH_HOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-run reads a registry writable by another party and a run-capable caller invokes the affected tool, the registry writer can choose the program and arguments executed with the operator's environment and workspace access.

The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, which are later concatenated into a tcpdump command and executed with root privileges. The vulnerability can be exploited without authentication if the device is in a factory-reset state.

An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a crafted POST request to the GraphQL endpoint.

A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory and read and overwrite files on the server via a crafted URL.

An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted URL.

The Webba Booking plugin (webba-booking-lite) is affected by a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. The issue affects Webba Booking from an unspecified version through 6.5.4.

RTIR extends RT's HTML scrubber to allow an internal link placeholder and lets through any link containing that placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only RTIR's own queues. Anyone who can add HTML content to a ticket, including an unauthenticated sender of HTML email to the Incident Reports queue (open to everyone by default), can store such a link, and the script runs in the session of the user who clicks it. The issue was fixed in versions 5.0.11 and 6.0.4.

RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an incident from a report, rendering that subject without HTML escaping. A ticket subject containing script runs it when a user opens either form. RTIR grants everyone the right to create Incident Reports by default, so an unauthenticated sender of an emailed report can set that subject, and the script runs in the session of the handler who creates or splits the incident. The issue was fixed in version 6.0.4; RTIR 5.0 is not affected.