CVE Vulnerability Catalog

In ApostropheCMS before 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQuery when an authenticated victim loads a page with the admin bundle. The parser accepts the special __proto__, constructor, and prototype path keys, allowing browser prototype mutation that can reach an unsafe DOM sink and execute script in the victim's session. Anonymous visitors do not load the affected admin context. The issue is fixed in version 4.33.0.

In aaPanel up to 8.25.0, the GetClientIp function in class/public/common.py manipulates the X-Real-Ip argument, leading to improper access controls. The attack may be performed remotely. The exploit has been made public and could be used. The vendor confirms that the reported X-Real-Ip IP-bypass vulnerability has already been fixed.

The Participants Database plugin (participants-database) for WordPress by xnau webdesign up to version 2.7.8.5 contains an authorization bypass through user-controlled key vulnerability. This allows exploitation of incorrectly configured access control security levels. The issue affects versions from n/a through 2.7.8.5.

A service account with user-management permissions in one organization can read, modify, disable, or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.

SolarWinds Patch Manager exposes sensitive information accessible to local users, which could be used to gain elevated privileges. The vulnerability allows a local attacker to obtain sensitive data.

SolarWinds Observability Self-Hosted is affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages. This may lead to session hijacking.

SolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated attackers to cause the application server to send requests to attacker-controlled or internal destinations.

Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated submissions can consume temporary disk storage and disrupt form handling or other host services.

Prior to 4.33.0, an authenticated editor with legitimate edit rights on a pre-existing ordinary page nested under a restricted parent can use the same-parent page move operation to change sibling ranks without create authorization on that parent. The bypass is limited to sibling ordering rather than arbitrary content modification, confidentiality loss, or creation of the restricted nesting.

Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end its discard region early when htmlparser2 emits an implied ancestor close inside noscript. Because scripting-enabled browsers treat noscript content as raw text while the parser does not model that mode, content intended to remain inert can survive sanitization and render.

Prior to 4.33.0, viewRole is not applied to anonymous visitors when a developer exposes user objects through a publicly rendered relationship or expressly enabled public API. Inadequately limited templates, including serialization of an entire related user object, can conditionally disclose user fields, but password hashes are stored separately and are not affected.

From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer() builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string.

In sanitize-html 2.18.0, when an <iframe> is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options). The recursion has no bound and starts each nested call with a fresh state.

Prior to 3.7.1 of the import-export module and 4.34.0 of core ApostropheCMS, an editor who can import an enabled content type but lacks its stronger publication role can cause import write helpers to create, replace, or remove published variants without the normal publish permission and lifecycle checks.

In aaPanel up to 8.25.0, the send_file function in BTPanel/routes/v2.py of the Download Endpoint component allows manipulation of the filename argument leading to path traversal. The attack can be executed remotely, the exploit has been published and may be used, and the vendor confirms the reported RCE and LFI vulnerabilities require authentication.

Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the style attribute and inject executable attributes when published content, or an affected draft viewed by a higher-privileged user, is rendered.

ApostropheCMS prior to 4.34.0 has a getOne REST endpoint for pages that does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a document _id can read the full content of admin-only pages and their privileged fields, while the getAll endpoint correctly enforces both restrictions.

In ThreadX, the module manager's thread-delete dispatcher released only the first of two allocations (the TX_THREAD control block and the TXM_MODULE_KERNEL_STACK_SIZE kernel stack). The kernel stack stayed allocated until the whole module was stopped, so a module creating and deleting threads in a loop exhausted the shared object pool, preventing creation of new kernel objects and module threads system-wide.

The block-pool create dispatcher in the ThreadX module manager validated only two ALIGN_TYPE words of the extra-parameter array supplied by a memory-protected module, then used indices 0 through 3. One unvalidated word is read by the dispatcher's own range check (index 1 as pool start, index 2 as length), so the out-of-bounds read is performed by the validation code before reaching the kernel service.

In the ThreadX module manager, object lookup validated only one byte of a memory-protected module's search name, then walked it in privileged mode with preemption raised. txm_module_object_pointer_get_extended is given a length but does not use it to bound the buffer, and the deprecated txm_module_object_pointer_get supplies the maximum UINT value, removing the bound.