CVE Vulnerability Catalog

Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network.

Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.

Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network.

A vulnerability in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network via '.../...//'.

Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.

Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network.

Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network.

Modification of assumed-immutable data (MAID) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.

Vulnerability in Traefik (before 2.11.53, 3.6.24, and 3.7.9) in the default HTTP reverse proxy. Forwarding CONNECT requests can lead to connection desynchronization, allowing an attacker to smuggle responses to another client.

A vulnerability in Dinky allows an unauthenticated attacker to write arbitrary files on the server via the /download/uploadFromRsByLocal endpoint. Lack of path validation and a hardcoded default token enable overwriting application files and executing code as the Dinky service account.

SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the `field` and `order` parameters in paginated list endpoints.

ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module, allowing a remote attacker to execute arbitrary code.

A vulnerability in Flowise (up to 3.1.4) in the OpenAI Assistants integration allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID without workspace ownership verification.

A vulnerability in Ground Station (before 0.6.0) allows unauthenticated attackers to destroy or replace the entire SQLite database by sending a full_restore command to the Socket.IO server on port 7000. Lack of authentication and wildcard CORS policy enable remote exploitation.

Prior to version 1.0.4, OpenReception's appointment booking software allowed unauthenticated attackers to store attacker-controlled ML-KEM-768 public keys for any tenant without authentication. The POST /api/tenants/{tenantId}/staff/{staffId}/crypto route logged a warning but still inserted the row, and a variant with omitted email field suppressed the warning entirely. This breaks the end-to-end encryption claim, as the attacker becomes an additional encryption recipient for future patient appointments.

A vulnerability in OpenReception (before 1.0.2) in WebAuthn registration allows an unauthenticated attacker to associate their own credential with a victim's account by manipulating the userId parameter in the URL. The validation does not check that the userId belongs to the email in the cookie.

A vulnerability in OpenReception's appointment booking software allows a TENANT_ADMIN to promote themselves or another staff member to the platform-wide GLOBAL_ADMIN role via a single PUT request. There is no policy check enforcing that only an existing GLOBAL_ADMIN can grant GLOBAL_ADMIN, so schema validation acts as the authorization decision. After re-login, the tenant admin gains full access to all other tenants on the platform.

OpenReception's appointment booking software before version 1.0.1 allows an unauthenticated attacker to create a GLOBAL_ADMIN account by sending a POST request to `/setup/create-admin-account`, without verifying that an admin already exists. The attacker gains full administrative control over the platform, and the new account is active and does not require email confirmation.

A vulnerability in the System REST API allows authenticated users with publisher privileges to upload files to arbitrary server-accessible locations due to insufficient validation of file type and destination. This could lead to code execution.