CVE Vulnerability Catalog

Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded traversal sequence in avatarId. Attackers can send percent-encoded ../ sequences to GET /client/v1/avatars/:avatarId to escape the avatars directory and read .jpeg files belonging to other workspaces.

FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment ID can replay forged payment notifications to repeatedly add payment amounts, marking invoices paid or overpaid.

AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileId. Attackers can enumerate predictable time-ordered Snowflake file IDs, since FileMapper.getFile performs no owner or tenant check, to retrieve S3-stored files uploaded by other tenants.

lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's department membership within the tenant.

A vulnerability was identified in cemtan sar2html 4.0.0. Affected is the function updateDb of the file sar2html.py of the component File Upload. The manipulation leads to path traversal. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.

Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because the runclone_command() function does not redact credentials from subprocess error output. To remediate this issue, users should upgrade to Amazon SageMaker Python SDK V3 3.10.0 or V2 2.257.3.

Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in the HTTP web-management login flow. An unauthenticated attacker on the same local network who can capture the network traffic associated with legitimate administrator login may be able to derive an alternative credential value that produces the same accepted authentication result and use it to authenticate to the device's web-management interface with administrator privileges. Exploitation requires the management login to use HTTP and the attacker to observe the session key, dictionary, and login value associated with a legitimate administrator login. Successful exploitation may allow an unauthenticated adjacent attacker to gain administrator access to the affected device and modify exposed configuration settings.

lichess.org is the forever free, adless and open source chess server. Prior to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4, a user who can add a chapter to a study can place attacker-controlled text in the PGN Annotator tag, which becomes Comment.Author.External and is returned verbatim by authorText. When a study node has at least two comments, ui/analyse/src/treeView/inlineView.ts interpolates that author string into HTML passed to the innerHTML hook without escaping it. Opening the affected study can therefore render stored attacker-controlled HTML and CSS for other viewers, including navigation to an attacker-controlled site, content spoofing, and CSS-based data exposure, although the site's content security policy blocks injected JavaScript. This vulnerability is fixed by commit c54596c9e1569d378fe20f80d4c790c6fdee54c4.

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users who can edit dataset fields and chart configuration can store an HTML-bearing dimension value in a bar-horizontal chart. When lengthLimit truncates the category axis label, configAxisLabelLengthLimit in core/core-frontend/src/views/chart/components/js/panel/common/common_antv.ts retrieves the full label and assigns it to the g2-tooltip-title element through innerHTML. A victim who opens the dashboard and hovers the truncated label can execute attacker-controlled JavaScript in the victim's DataEase session. This issue is fixed in version 2.10.26.

In DataEase prior to 2.10.26, an authenticated user with folder creation permission can store HTML-bearing names. When another user opens the Move to dialog and types in its search box, attacker-controlled JavaScript executes in the victim's session (XSS).

In pipecat-ai from 0.0.98 until 1.6.0, the built-in development runner exposes unauthenticated endpoints /start, /daily, and /daily-dialin-webhook that can create bot sessions and Daily rooms. The runner binds to localhost by default, so exploitation requires exposing it to untrusted traffic (e.g., via --host 0.0.0.0, a published port, or a tunnel).

The Vert.x HTTP/1.x decoder in versions [5.0.0,5.0.12], [5.1.0,5.1.9], and [5.2.0,5.2.0] uses canonicalization for well-known HTTP headers that misinterprets crafted headers as listed headers, e.g., Content-Xength as Content-Length. This enables request smuggling attacks.

In Eclipse Vert.x versions [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9], and 5.2.0, the vertx-mail-client does not sanitize CR/LF characters in user-supplied email header names and values before writing them to the SMTP DATA section. Injecting CR/LF sequences allows adding arbitrary headers (e.g., Bcc, Reply-To) or prepending body content; the same weakness affects MIME part metadata.

Eclipse Vert.x Web versions [4.0.0,4.5.34], [5.0.0,5.0.12], [5.1.0,5.1.9], and [5.2.0,5.2.0] contain a scope bypass vulnerability in ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already authenticated by a preceding handler, ChainAuthHandler skips all scope validation configured via withScope() or withScopes().

In BentoPDF through 2.8.6, cloudflare/cors-proxy-worker.js performs a DNS-over-HTTPS safety check in hostnameResolvesToPrivate() separately from the outbound fetch. In deployments without PROXY_SECRET validation, an attacker controlling authoritative DNS can forge the Origin header and supply a certificate, OCSP, CRL, or TSA URL that passes path checks, returning a public address during validation and a private one during the later fetch.

In F´ (F Prime) prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because a wrapping sum bypasses the range check, becomes m_endOffset, and leaves m_byteOffset greater than the wrapped end offset. When an existing source file is larger than the supplied startOffset and a length causes the U32 sum to wrap, the first data-packet send reaches FW_ASSERT and aborts or resets the process.

In F´ (F Prime) prior to 4.3.0, Svc::TlmPacketizer TlmRecv_handler copies val.getSize bytes into fixed-slot entry.channelSize storage without confirming the runtime value fits. When a telemetry update for a configured channel carries a larger serialized value, it overwrites adjacent channel fields and emits corrupted packetized telemetry.

In F´ (F Prime) prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because unchecked startOffset plus length arithmetic bypasses the range check and stores a wrapped m_endOffset inconsistent with m_byteOffset. When the source file is larger than a valid startOffset and a length causes the U32 sum to wrap below the file size, the first data-packet transition reaches FW_ASSERT and aborts or resets the process.

In F´ (F Prime) prior to 4.3.0, Svc::EventManager loqQueue_internalInterfaceHandler packetization is vulnerable because EventManager accepts up to the LogBuffer maximum, but packet descriptor, event identifier, and time-tag metadata consume part of the larger ComBuffer, leaving a smaller budget for log arguments; serialization failure then reaches an assertion. When a deployment bridges events through GenericHub into EventManager and forwards a legal Fw::LogBuffer larger than the remaining budget, standard assertion handling aborts or resets the process.

A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption.