CVE Vulnerability Catalog

In SOCFortress CoPilot prior to 0.1.76, the POST /api/agent_data_store/upload endpoint allows customer_user callers to choose bucket_name and object_name without an allowlist, tenant prefix, or ownership check. This enables overwriting objects belonging to any tenant, including sysmon configs, report templates, and case evidence. The issue is fixed in version 0.1.76.

In libass prior to 0.17.5, wrap_lines_measure can overread and overwrite the glyph array while rendering malicious ASS content. In certain wrap modes, a line ending with a literal backslash-n sequence can cause the measurement loops to overshoot by one glyph, leading to an uninitialized read and an out-of-bounds write. The issue is fixed in version 0.17.5.

In libass from 0.17.4 until 0.17.5, event pruning does not guard against negative Matroska ReadOrder values, allowing an attacker to clear bits at attacker-controlled positions near the NULL pointer. Exploitation requires a malicious Matroska stream, enabled read-order checking, and later pruning of malicious events. The issue is fixed in version 0.17.5.

In Chamilo LMS prior to 2.0.1, career.lib.php and import_csv.php call PHP's native unserialize() on user_career.extra_data from the database without the allowed_classes: false option. An attacker able to write crafted serialized PHP objects can trigger POP gadget chains in Symfony, Doctrine, or Monolog components, leading to arbitrary OS command execution. The issue is fixed in version 2.0.1.

In Chamilo LMS from 2.0.0 until 2.0.1, GET /user/{username} is anonymously reachable and renders six user-editable profile fields inside {% autoescape false %} without server-side sanitization. A ROLE_STUDENT attacker can plant HTML in their profile that executes in the browser of any visitor, including administrators. The issue is fixed in version 2.0.1.

An improper access control vulnerability exists in the MFA functionality of ManageEngine SharePoint Manager Plus (SPMP). A low-privileged authenticated user can bypass authorization checks to read and modify MFA settings, enable or disable MFA, enumerate MFA-enrolled users, and delete MFA-enrolled accounts. The issue is fixed in build 4507.

A stored XSS vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript into attributes used to generate charts, including users' full names, site names, or group names. The injected content is stored and executed in other users' browsers when charts are rendered. The issue is fixed in build 4508.

Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via /api/v1/auth/login to modify library and configuration settings and install JavaScript plugins running in QuickJS.

CoreShop by CoreUnion through 1.5.5 contains an unauthenticated SQL injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind techniques to extract member accounts and orders.

CoreShop through 1.5.5 contains an unauthenticated SQL injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind techniques to extract member accounts and orders.

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign themselves the administrator role and gain full control of the instance.

Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete().

DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require_once. Attackers can supply path traversal sequences ../../ to include arbitrary local files outside the intended payment directory, potentially achieving local file disclosure. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

Dell OpenManage Enterprise versions prior to 4.8.0 contain an authentication bypass by spoofing vulnerability. An unauthenticated attacker with adjacent network access could exploit it, leading to session theft.

Dell OpenManage Enterprise versions prior to 4.8.0 contain an OS command injection vulnerability. A low-privileged attacker with remote access could exploit it, leading to command execution.

Dell OpenManage Enterprise versions prior to 4.8.0 contain a use of hard-coded cryptographic key vulnerability. A low-privileged attacker with local access could exploit it, leading to information disclosure.

Vatos DLP by Crypttech contains a plaintext storage of a password vulnerability, allowing use of known domain credentials. The issue affects versions from 1.1.176 before 1.1.243.

MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo_from_json(). Attackers can run Python code via a crafted algo_object.json in a work directory.

Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass in the Kubernetes Ingress NGINX provider that silently disables mTLS configured via the auth-tls-secret annotation. When another Ingress declares a path on the same host without matching auth-tls settings, Traefik falls back to default TLS options.

A flaw was found in GIMP's PSD plug-in: the image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution.