CVE Vulnerability Catalog

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 2.2.3, a stored XSS vulnerability exists due to improper handling of uploaded SVG files; the application accepts SVG uploads without sanitizing or restricting embedded script content, allowing execution of malicious scripts in the application context.

mdast-util-to-hast is an mdast utility to transform to hast. From 13.0.0 to before 13.2.1, multiple (unprefixed) classnames could be added in markdown source by using character references, making rendered user-supplied markdown code elements appear like the rest of the page. This vulnerability is fixed in 13.2.1.

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/accounts/groups/Grupo endpoint. Attackers can inject malicious scripts into the data[readableName] parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed, posing a significant security risk. This vulnerability is fixed in 1.11.0-beta.1.

The admin plugin for Grav (an HTML user interface for configuring Grav and editing pages) contains a Stored Cross-Site Scripting (XSS) vulnerability in the /admin/pages/[page] endpoint. Attackers can inject malicious scripts into the data[header][metadata], data[header][taxonomy][category], and data[header][taxonomy][tag] parameters, which are stored in the page frontmatter and executed whenever the page is accessed or rendered in the administrative interface. The vulnerability is fixed in version 1.11.0-beta.1.

The admin plugin for Grav (prior to 1.11.0-beta.1) contains a user enumeration and email disclosure vulnerability. The "Forgot Password" functionality at /admin/forgot leaks information about valid usernames and their associated email addresses through distinct server responses. This vulnerability is fixed in 1.11.0-beta.1.

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, there is an IDOR (Insecure Direct Object Reference) vulnerability in the Grav CMS Admin Panel which allows low-privilege users to access sensitive information from other accounts. Although direct account takeover is not possible, admin email addresses and other metadata can be exposed.

In Grav prior to 1.8.0-beta.27, users with read access to the user account management section of the admin panel can view password hashes of all users, including the admin. This exposure can potentially lead to privilege escalation if an attacker cracks these hashes.

In Grav prior to 1.8.0-beta.27, a Denial of Service (DoS) vulnerability exists related to the handling of the scheduled_at parameter. The application fails to properly sanitize cron expressions, allowing an attacker to render the admin panel non-functional by manipulating the parameter, such as with a single quote.

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a path traversal vulnerability has been identified in Grav CMS, allowing authenticated attackers with administrative privileges to read arbitrary files on the underlying server filesystem. This vulnerability arises due to insufficient input sanitization in the backup tool, where user-supplied paths are not properly restricted, enabling access to files outside the intended webroot directory.

Snipe-IT before version 8.3.4 is vulnerable to stored XSS via the Locations "Country" field. A low-privileged authenticated user can inject JavaScript that executes in another user's session.

Frappe prior to 15.86.0 and 14.99.2 was vulnerable to path traversal attacks, allowing retrieval of certain server files if the full path was known. Sites on Frappe Cloud and setups behind a reverse proxy like NGINX are unaffected; mainly direct werkzeug/gunicorn deployments are impacted.

A stored XSS vulnerability in Snipe-IT before version 8.3.4 allows a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enabling privilege escalation.

JumpServer is an open source bastion host and operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, the /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability. This vulnerability is fixed in v3.10.19 and v4.10.5.

Todoist v8896 is vulnerable to Cross Site Scripting (XSS) in /api/v1/uploads. Uploaded SVG files are not sanitized, so embedded JavaScript executes when a user opens the attachment from a task or comment.

Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate user permissions when deleting comments in Boards, which allows an authenticated user with the editor role to delete comments created by other users.

A use-after-free in the MPEG1or2Demux::newElementaryStream() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG Program stream.

A carefully crafted DLL copied to the C:\ProgramData\Synaptics folder allows a local user to execute arbitrary code with elevated privileges during driver installation.

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues.

The Arconix Shortcodes plugin for WordPress is vulnerable to stored XSS due to improper neutralization of input during web page generation. This issue affects versions up to and including 2.1.20.

In Search Guard FLX versions from 3.1.0 up to 4.0.0 with enterprise modules disabled, authenticated users can use specially crafted requests to read documents from data streams without having the respective privileges.