CVE Vulnerability Catalog

A use-after-free (UAF) vulnerability exists in the screen management module. Successful exploitation may affect availability.

A race condition vulnerability was found in the event notification module. Successful exploitation of this vulnerability may affect availability.

A race condition vulnerability exists in the notification service. Successful exploitation may affect availability.

1Panel-dev MaxKB up to 2.6.1 contains a Cross-Site Scripting (XSS) vulnerability in the ChatHeadersMiddleware component (apps/common/middleware/chat_headers_middleware.py). Manipulating the Name argument enables remote attack. A fix was released in version 2.8.0 (commit 026a2d623e2aa5efa67c4834651e79d5d7cab1da).

A vulnerability was detected in 1Panel-dev MaxKB up to 2.2.1. It affects the StaticHeadersMiddleware function in apps/common/middleware/static_headers_middleware.py within the Public Chat Interface component. Manipulation of the Name argument results in cross site scripting, and the attack may be launched remotely.

Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash. The vulnerability is fixed in 1.20.4 and 1.21.1.

In TREK (a collaborative travel planner) prior to version 2.7.2, uploaded photos were served without requiring authentication. The vulnerability is fixed in version 2.7.2.

Step CA from 0.24.0 to before 0.30.0-rc3 allows an attacker to trigger an index out-of-bounds panic by sending a crafted attestation key (AK) certificate with an empty Extended Key Usage extension during TPM device attestation. The vulnerability is only reachable when a device-attest-01 ACME challenge with TPM attestation is configured.

A security flaw has been discovered in musl libc up to 1.2.6. The iconv function in src/locale/iconv.c, within the GB18030 4-byte Decoder component, is affected. Manipulation results in inefficient algorithmic complexity, and the attack must be initiated from a local position.

A cross-site scripting vulnerability was detected in code-projects Simple IT Discussion Forum 1.0 in the file /admin/user.php due to manipulation of the fname argument. The attack can be performed remotely and the exploit has been publicly disclosed.

W OpenStack Keystone w wersjach od 14 do 26 przed 26.1.1, 27.0.0, 28.0.0 i 29.0.0 odkryto problem, który pozwala na tworzenie poświadczeń EC2 przez ograniczone poświadczenia aplikacji. Użytkownik z rolą tylko do odczytu może uzyskać pełne uprawnienia S3 rodzica, omijając ograniczenia ról nałożone na poświadczenia aplikacji.

Flux notification-controller before 1.8.3 does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication in the gcr Receiver type. This allows any valid Google-issued token to authenticate against the Receiver webhook endpoint and trigger unauthorized Flux reconciliations if the attacker knows the webhook URL. The webhook path is hard to discover without cluster access or leaked secrets.

Beszel is a server monitoring platform. Prior to 0.18.7, some API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that the user should have access to that system. As a result, any authenticated user can access these routes for any system if they know the system's ID. System IDs are random 15 character alphanumeric strings, and are not exposed to all users. However, it is theoretically possible for an authenticated user to enumerate a valid system ID via web API. To use the containers endpoints, the user would also need to enumerate a container ID, which is 12 digit hexadecimal string.

The code-projects Online Shoe Store 1.0 is vulnerable to XSS in /admin/admin_product.php via the product_name argument. The attack is remote and the exploit is public.

The code-projects Online Shoe Store 1.0 is vulnerable to XSS in /admin/admin_football.php via the product_name argument. The attack is remote and the exploit is public.

The code-projects Online Shoe Store 1.0 is vulnerable to XSS in /admin/admin_running.php via the product_name argument. The attack is remote and the exploit is public.

In GitLab CE/EE from version 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3, an authenticated user with custom role permissions can demote or remove higher-privileged group members due to improper authorization checks.

A cross-site scripting vulnerability was found in SourceCodester Sales and Inventory System 1.0 in the /delete.php file of the GET Parameter Handler component. Manipulation of the ID argument allows remote XSS attacks. The exploit has been published.

A cross-site scripting vulnerability has been detected in code-projects Easy Blog Site 1.0. The issue is in the /posts/update.php file where the postTitle argument is not properly sanitized. The attack can be performed remotely and the exploit has been publicly disclosed.

In LORIS (versions 20.0.0 to 27.0.3 and 28.0.1), a vulnerability in the publication module allows an attacker to forge the baseURL in a POST request, potentially sending an email to an external domain under the attacker's control that appears to come from LORIS. The vulnerability is fixed in versions 27.0.3 and 28.0.1.