CVE Vulnerability Catalog

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

The product fails to sufficiently validate callback URLs, allowing manipulation with malicious payloads via weak regular expressions or omitted validation. An attacker can craft a legitimate-looking link that redirects users to an attacker-controlled page.

An integer overflow vulnerability exists in the Qt XML parsing functionality (Qt5Compat / QXmlSimpleReader). It may cause incorrect parser behavior when processing crafted XML data.

The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing account lockout mechanisms.

Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to authenticated remote code execution in the Log Forward option. An authenticated user can exploit this to execute arbitrary code on the server.

The Admin REST API accepts user-supplied input without adequate sanitization, allowing it to be included in the structure of SQL statements. A user with administrator privileges can influence the structure of executed SQL statements, enabling blind SQL injection to infer database information and potentially impact database service availability.

Fastify versions 5.8.0 through 5.12.7, when configured with a nonzero handlerTimeout and a route returns a streaming response, a request whose stream has sent headers but stays open past the timeout crashes the server. When the timeout fires, Fastify tries to send a new error response on an already-started response, raising an uncaught ERR_HTTP_HEADERS_SENT that terminates the Node.js process.

@fastify/cors is the CORS plugin for the Fastify web framework. In versions 8.2.0 through 11.3.x, an application that registers the plugin with the non-default onSend hook option crashes on a CORS preflight. On an OPTIONS request carrying the Origin and Access-Control-Request-Method headers, the plugin calls reply.send from inside the onSend hook and re-enters the send pipeline, so a second write of the response headers throws an uncaught ERR_HTTP_HEADERS_SENT that can terminate the Node.js process when no process-level handler is installed.

@fastify/http-proxy versions 11.6.0 through 11.6.2 normalize literal backslashes before percent-decoding the request path, so a path encoding backslashes and dot-segments survives the dot-segment check and only becomes backslash and double-dot sequences afterward. When the upstream treats backslash as a path separator, the forwarded request walks out of the configured proxy prefix and reaches a sibling upstream location.

@fastify/http-proxy versions 9.0.0 through 11.6.5 substitute URL-decoded route parameters into rewritePrefix without re-encoding them. A parameter value encoding a path separator with a fragment or query delimiter decodes into real separators, injecting extra upstream path segments and stripping the mandatory suffix. An unauthenticated remote attacker can reach upstream locations outside the intended prefix, leading to path-restriction bypass and, depending on the upstream, SSRF or authorization bypass.

@fastify/secure-session versions 7.5.0 through 8.4.1, when configured with the signed cookie option, calls the cookie unsign routine but still passes the original cookie value to the session decoder when the signature check reports it invalid, so a session with an invalid signature is decrypted anyway. This matters when an application uses a signing secret separate from the encryption key and rotates only the signing secret to retire sessions while keeping the encryption key active.

@fastify/multipart versions 5.3.0 through 10.1.6 does not propagate a parser error to the file stream when a request body ends inside a file part with no closing boundary, even though Content-Length is complete, the client does not abort, and no file size limit is exceeded. The plugin destroys the in-progress file stream without an error, so a handler doing asynchronous work before consuming the file attaches to a stream that never emits an error or end event, and the request never responds.

@fastify/reply-from versions up to and including 12.8.0 validate proxy paths only against forward-slash dot-segments, then build the target with the WHATWG URL parser, which normalizes backslash and its percent-encoded form to a forward slash. A path using backslash dot-segments bypasses the traversal check and resolves to a different upstream path. An unauthenticated request can escape the intended prefix and reach other upstream endpoints.

The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to inject malicious scripts. This can be exploited by uploading a crafted SVG file that is stored and rendered by the application. Consequences include redirecting the victim's browser to an arbitrary website, modifying the page UI, or retrieving browser information, though impact is mitigated as sensitive session cookies are protected with the httpOnly flag.

The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that redirects users to an arbitrary external domain. By leveraging this open redirection vulnerability, an attacker can craft a malicious link that redirects users to an attacker-controlled page.

When an Event Publisher output adapter is configured with properties irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confidential information depending on the nature of the misconfigured property.

SQL injection vulnerability classified as an internal threat level. Attackers can steal database information via SQL injection while logged in.

The affected component fails to enforce expected validation constraints on the 'content-type' header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated 'content-type' header.

The user search function within the management console fails to properly encode user-supplied input before rendering it in the browser. This allows an attacker to inject malicious scripts that are then executed by the user's browser in the context of the management console.

A memory corruption vulnerability exists in the QMqttClient class of the Qt MQTT module. Under certain MQTT 5 connection settings between client and server, QMqttClient may corrupt memory, which can cause the application to crash.