CVE Vulnerability Catalog

Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete().

Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. An attacker can submit host search conditions targeting other businesses or omitting business filters to retrieve host attributes and topology association details, because the route is mapped to SkipAction and SearchHostWithAsstDetail skips AuthorizeSearchHost.

RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other departments. Users holding system:user:list under a department-restricted role can request GET /system/user/list/dept/{deptId} with any department id to obtain usernames, nicknames, account status, last login IP and time, and remarks.

Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with view_reports on one site can supply that siteId with another site's session_id or order_id to read its visit history, IP addresses, user agents and order data.

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and restricted library, product, project, or team documents.

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star endpoints to permanently delete victims' images and stored files or change their star status.

Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JetFormBuilder: from n/a through 3.6.7.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS. This issue affects The Events Calendar: from n/a through 6.18.2.

Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Events Calendar: from n/a through 6.18.2.

Bitcoin Core prior to versions 29.5, 30.4, 31.2, and 32.1 is vulnerable to an out-of-memory (OOM) issue. The flaw can cause node malfunction due to insufficient memory resources.

Bitcoin Core through version 31.1 is vulnerable to a Denial of Service attack via undo files that have no size limit. The lack of size restriction may allow resource exhaustion and node destabilization.

Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Timetics: from n/a through 1.0.65.

In Vvveb prior to version 1.0.8.7, an authenticated IDOR on the admin/auth-token endpoint allows any administrator to read and overwrite another administrator's API tokens. The issue has been patched in version 1.0.8.7.

An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module. It may lead to memory corruption when processing a malicious scene file.

In Vvveb prior to version 1.0.8.7, the password reset functionality is vulnerable to an authentication bypass due to insufficient validation of the user and token GET parameters. The issue has been patched in version 1.0.8.7.

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/view_server_log.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HTML response without output encoding. Attackers can craft a malicious URL and induce a user to request it, resulting in arbitrary JavaScript execution within the victim's browser session against the Netsweeper web administration interface. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require_once. Attackers can supply path traversal sequences ../../ to include arbitrary local files outside the intended payment directory, potentially achieving local file disclosure. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

Dell OpenManage Enterprise versions prior to 4.8.0 contain an Injection vulnerability due to improper neutralization of special elements in output used by a downstream component. A high-privileged attacker with adjacent network access could exploit it to inject scripts.

Dell OpenManage Enterprise versions prior to 4.8.0 contain an authentication bypass by spoofing vulnerability. An unauthenticated attacker with adjacent network access could exploit it, leading to session theft.

Dell OpenManage Enterprise versions prior to 4.8.0 contain an OS command injection vulnerability. A low-privileged attacker with remote access could exploit it, leading to command execution.