CVE Vulnerability Catalog

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 only allows IPv6 addresses in square brackets; IPv4 addresses and hostnames must not appear there. Parse did not enforce this requirement.

Prior to September 19, 2025, the Hospital Manager Backend Services returned verbose ASP.NET error pages for invalid WebResource.axd requests, disclosing framework and ASP.NET version information, stack traces, internal paths, and the insecure configuration 'customErrors mode="Off"', which could have facilitated reconnaissance by unauthenticated attackers.

A Directory Traversal Information Disclosure vulnerability in the DatabaseBackupBL class of Allegra allows remote attackers to disclose sensitive information on affected installations. The flaw results from the lack of proper validation of a user-supplied path prior to using it in file operations. Authentication is required, and an attacker can leverage this to disclose information in the context of the service account.

CKAN is an open-source DMS for data hubs and portals. Prior to 2.10.9 and 2.11.4, session IDs could be fixed by an attacker if the site uses server-side session storage (CKAN uses cookie-based storage by default). The attacker would need to set a cookie on the victim's browser or steal a valid session. Session identifiers are now regenerated after each login.

A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client on Windows allows a local user to execute arbitrary commands with elevated privileges. This is an additional unmitigated attack path for CVE-2024-4944. The vulnerability is fixed in version 12.11.5 of the client.

An unauthenticated server-side request forgery (SSRF) vulnerability exists in the Thumbnail via-uri endpoint of Halo CMS 2.21. A remote attacker can force the server to make HTTP requests to attacker-controlled URLs, including internal network addresses.

SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false.

Prior to 2.10.9 and 2.11.4, the helpers.markdown_extract() function did not perform sufficient sanitization of input data before wrapping in an HTML literal element. This helper is used to render user-provided data on dataset, resource, organization or group pages, leading to a potential XSS vector.

In Search Guard versions 3.1.1 and earlier, Field Masking (FM) rules are improperly enforced on fields of type IP (IP Address). While the content of these fields is properly redacted in the _source document returned by search operations, the results do return documents (hits) when searching based on specific IP values. This allows to reconstruct the original contents of the field.

In Search Guard FLX versions 3.1.1 and earlier, Field-Level Security (FLS) rules are improperly enforced on object-valued fields. When an FLS exclusion rule (e.g., ~field) is applied to a field which contains an object as its value, the object is correctly removed from the _source returned by search operations. However, the object members (i.e., child attributes) remain accessible to search queries. This exposure allows adversaries to infer or reconstruct the original contents of the excluded object.

A vulnerability has been identified in Rancher Manager, where sensitive information, including secret data, cluster import URLs, and registration tokens, is exposed to any entity with access to Rancher audit logs.

The Jenkins Publish to Bitbucket plugin version 0.4 and earlier has a missing permission check. An attacker with Overall/Read permission can connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

The Jenkins Publish to Bitbucket Plugin version 0.4 and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability. It allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

Jenkins Curseforge Publisher Plugin 1.0 stores API keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the controller file system.

Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the controller file system.

Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Jenkins Nexus Task Runner Plugin 0.9.2 and earlier does not perform a permission check, allowing attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.