CVE Vulnerability Catalog

Centreon contains an SQL injection vulnerability that allows an authenticated user with access to ACL management to read and modify the Centreon database. The flaw enables manipulation of database data beyond the user's intended permissions.

Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 might allow an authenticated remote user to obtain certificates, including subordinate CA certificates, signed by a cluster-scoped AWS Private CA issuer that their approval policy does not authorize. Remediation requires upgrading to v1.10.1 or the EKS add-on v1.10.1-eksbuild.1 and updating certificate requests, Certificate resources, or Ingress annotations whose issuerRef.kind is missing, incorrect, or does not match the referenced issuer.

In the Botan C++ cryptography library, from 3.7.0 until 3.13.0, an application that calls AutoSeeded_RNG::clear() and then calls randomize with an empty output buffer while the generator is unseeded can cause AutoSeeded_RNG to mark itself seeded without consulting the configured entropy source. On builds without BOTAN_HAS_SYSTEM_RNG, the fallback uses only a clock value and process ID, so a later non-empty request can produce output from predictable state. This is fixed in version 3.13.0.

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.0 and prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.

In sigstore-js prior to 0.7.2, packages/oci/src/registry.ts contains a RegistryClient.signIn() method that stores registry Authorization and Docker configuration headers as defaults on a shared HTTP client, while RegistryClient.uploadBlob() sends a fresh PUT to an absolute blob-upload Location supplied by the registry without checking that its origin or scheme matches the registry. A malicious or compromised registry can therefore direct a user pushing an artifact through attachArtifactToImage() to an attacker-controlled host and receive the registry bearer token, Basic credentials, or custom authentication headers. Version 0.7.2 fixes the issue by separating registry credentials from client-wide defaults and sending them only to the registry origin.

In the Monkeytype repository, the .github/workflows/fix-formatting.yml workflow runs on pull_request_target with repository write permissions, checks out a fork pull request, installs dependencies from the fork's package.json, and invokes the fork-controlled oxfmt binary. Because actions/checkout persists the elevated GITHUB_TOKEN in Git configuration until after untrusted code executes, an external contributor can run arbitrary code, read or exfiltrate the token, and push repository content or modify pull requests and issues. The issue affects the repository CI workflow, not the Monkeytype application or user data, and is fixed in version 26.43.0.

In Kubeflow Pipelines prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. This is fixed in version 2.18.0.

In Kubeflow Pipelines from 0.5.1 until 2.17.0, frontend artifact routes did not check whether an authenticated user was authorized to access the requested namespace. A user knowing an artifact location could select another tenant's namespace or omit the namespace to read artifact contents such as datasets, models, or pipeline outputs.

In Kubeflow Pipelines prior to 2.18.0, the GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler retrieved logs without authorizing the caller against the selected run. A caller knowing a run ID and pod or node identifier could read logs with the API server's permissions, and for live logs the node ID was accepted as a pod name without verifying pod membership in the run.

In Kubeflow Pipelines prior to 2.18.0, the volume artifact handler GET /artifacts/get?source=volume did not confine a caller-supplied file path to the selected volume. A caller knowing an existing mounted volume could use path traversal to read files outside it when the artifact-serving process could read them.

Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and macOS may allow authenticated local users to gain elevated privileges. Exploitation requires existing local access and depends on the Agent's inventory collection processing the crafted path.

Insecure permissions in Tailscale (versionCode 297862600) allow unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.

An issue in Nextcloud (versionCode 30390190) allows attackers to force victim users to log out and switch to an attacker-controlled profile, bypassing authentication.

An issue in Shelter (versionCode 445) allows attackers to register their own auth_key and take over another user's binder service API and preference state.

An issue in AndBible (versionCode 1111) allows attackers to execute arbitrary code by uploading a crafted module zip.

Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks (versionCode 6751) allow unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message.

Insecure permissions in the autosave component of AppML neutriNote CE (versionCode 1387) allow unauthorized attackers to write arbitrary files.

Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allow unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside of the sandbox.

Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allow unauthorized attackers to arbitrarily read files outside of the sandbox by providing an absolute path.

Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allow unauthorized attackers to arbitrarily manipulate another user's FHEM home-automation control configurations.