CVE Vulnerability Catalog

In Mercury from 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Event-handler attributes and other active HTML can reach the DOM and execute when another user views the application.

The Management Console and product files expose sensitive data, including remote log server credentials, truststore passwords, and keystore passwords, in plain text. This occurs because the system does not sufficiently protect these credentials when the remote logging feature is enabled.

The ForgeRock client fails to correctly validate refresh tokens. A refresh token can be treated as a valid access token, enabling its use for consuming protected resources and bypassing the requirement for valid client credentials.

The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing injection of malicious scripts. Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the victim's browser context.

The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist, allowing attackers to differentiate between valid and invalid usernames. This difference can be leveraged to enumerate existing user accounts.

Tokens associated with user sessions are not revoked when the session is terminated, unless another SSO request is initiated. This occurs when session-bound token validation is enabled and the "Revoke token upon user logout" option is inactive.

A gap in the Netskope Client (NSClient) allows a system connecting to a Captive Portal access point to switch to a network with internet connectivity without closing the Captive Portal. This enables abuse via a rogue access point to access malicious sites or exfiltrate data.

Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetch_ssl_certificate=true with crafted userinfo URLs so SSLCertificate.from_url connects to internal hosts on port 443, probing reachability and leaking certificate details.

docling-core 2.5.0 before 2.103.0 contains a local file disclosure vulnerability that allows attackers to read local images by supplying plain filesystem paths in ImageRef URIs, bypassing the allow_image_file_uri gate. Attackers can submit crafted DoclingDocument JSON or YAML that, when exported with ImageRefMode.EMBEDDED or rendered to HTML, embeds readable local image files as base64 and reveals path existence.

GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers to steal the gd_resource cookie by supplying attacker-controlled resource URLs in project files. Attackers can get victims to open a crafted project, causing downloadLocalFile() to send the cookie to their server and expose private cloud project resources.

A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. The same_check function in ipt_SAME.ko can lead to an integer overflow. The attack may be launched remotely.

FOSSBilling from 0.1.0 until 0.8.7 has an unauthenticated POST /api/guest/client/create endpoint that reveals whether a submitted email belongs to a registered client by returning a distinct unredacted error. An attacker can compare responses to determine if an email belongs to an existing client.

FOSSBilling from 0.1.0 until 0.8.7 has a path traversal vulnerability in the unauthenticated api/guest/system/template_exists endpoint because templateExists uses Path::join on the attacker-controlled file parameter without rejecting .. sequences or verifying the resolved path stays inside the active theme directory. An attacker can determine whether arbitrary files or directories exist on the server.

Camunda 7.24.0 before 7.24.16 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled().

Missing authorization in the Sieve notify action (versions 6.2.22 through 6.3.6) and in the mail-rule Reply action (versions 6.0.0 through 6.3.6) of Progressive Robot hMailServer allows an authenticated user to send mail through the server as any address. The server sets the From header to the :from value from the Sieve script or Reply action without verifying that the address belongs to the account. If the claimed address is at a domain hosted by the server with DKIM signing enabled, the message is signed with that domain's key, producing forged mail aligned to pass the domain's DMARC policy.

Missing authorization in the Sieve editheader action (versions 6.2.22 through 6.3.6) and in the mail-rule Set header value action (versions 6.0.0 through 6.3.6) of Progressive Robot hMailServer allows an authenticated user to modify From, Sender, Resent-From, Resent-Sender, and DKIM-Signature headers and then redirect messages, causing the server to send mail as any address, DKIM-signed where the address is at a hosted domain. This enables forgery aligned to pass the domain's DMARC.

Dell Application Installer versions prior to 26.09.0.1 contain a Missing Encryption of Sensitive Data vulnerability. An unauthenticated attacker with local access could exploit this vulnerability, leading to unauthorized access.

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting post_id to valid post types. Authenticated attackers, including unprivileged Subscribers, can supply an arbitrary post_id for any course, lesson, or quiz to create a private message addressed to that post's author, bypassing enrollment checks.

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions.

A vulnerability was found in ai-genius-automations octoally up to 1.0.87 in an unknown function of server/src/index.ts. Manipulating the path argument results in information disclosure, and the attack may be initiated remotely. The exploit has been made public and could be used.