CVE Vulnerability Catalog

CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. The function builds /^${rx}$/ without grouping the pattern, so an alternation such as yes|no accepts any value starting with yes or ending with no, and $ also accepts a value with one trailing newline.

CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. login() writes the login name to the application log without escaping control characters, and the login RPC method needs no authentication.

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The before_dispatch hook removes PATH_INFO from the request URI with a substitution that interpolates PATH_INFO unquoted, so the client chooses both the pattern and the matched string.

CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup. restoreConfigBlob() feeds the database dump to the sqlite3 command-line shell, which runs lines starting with a dot as its own commands, so .shell or .system runs an OS command and .load loads native code.

In CallBackery versions before 0.62.0 for Perl, configuration backups are encrypted with an AES key formed by padding the password with "x" characters and truncating to 32 bytes, with no salt and no key derivation. The first block of a backup holds a 16 hex digit length field, so decrypting one block confirms a password guess at raw AES speed.

In CallBackery versions before 0.62.0 for Perl, taking a configuration backup leaves a world-readable dump of the configuration database in /tmp. getConfigBlob() has the sqlite3 shell write the dump to /tmp/cbdump<pid> and never removes it; the file takes the process umask, and a symlink planted at that predictable name is followed.

In CallBackery versions before 0.60.1 for Perl, unauthenticated clients can read the POD of any file via path traversal in the /doc route. The route passes the requested name to Pod::Simple::Search->find without validation, and find splits the name on "::" and joins the parts into a file path, so a name such as "..::..::..::etc::motd" escapes @INC.

In HTTP::Parser::XS versions before 0.18 for Perl, parse_http_request truncates PATH_INFO at an encoded NUL byte. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00; the pure-Perl backend is not affected.

In Starlet versions from 0.20 before 0.33 for Perl, memory exhaustion is possible via unbounded buffering when decoding chunked request bodies. The decoder adds each read to one buffer of unconsumed input; nothing limits the length of a chunk-size line, so a line without a CRLF grows the buffer for as long as the client keeps sending, and the read timeout restarts after every read; the data of a large chunk is also held in the buffer until the whole chunk has arrived.

In Starlet versions before 0.33 for Perl, responses to HEAD requests include a body, corrupting the next response on a persistent or pipelined connection. The request method is not passed to the response writer, so whatever body the application returns for a HEAD request is sent; with Plack::Middleware::Head the body is empty, but an HTTP/1.1 response without a Content-Length header still gets the chunked encoding terminator; responses with status 204 or 304 are also sent with their body.

In Starlet versions from 0.20 before 0.33 for Perl, CPU exhaustion is possible via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a run of hex digits, then .* and a CRLF; a run followed by a bare LF and then a CRLF can never match, and the engine retries the match once for each digit, so the time taken grows with the square of the run length; nothing limits the length of the run, which can span several reads.

In Starlet versions before 0.33 for Perl, a request declaring a large Content-Length can kill a worker by exhausting memory. The request body is read in a loop that asks sysread for all of the remaining declared length at once; Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called.

FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint (POST /api/guest/staff/login). checkGuestClientAuthentication() only allowlists client_login and client_create, leaving staff_login without CSRF or Origin validation, allowing remote attackers to force authentication.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.

Dell OpenManage Enterprise versions prior to 4.8.0 contain an Insufficiently Protected Credentials vulnerability. A low-privileged attacker with remote access could potentially exploit this vulnerability, leading to information disclosure.

Dell OpenManage Enterprise versions prior to 4.8.0 contain an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to the launch of phishing attacks.

SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service.

SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3.

vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.