CVE Vulnerability Catalog

FrontMCP prior to 1.5.7 has a vulnerability in the codecall:execute tool that allows sandbox escape and remote code execution. By exploiting Zod objects, a script can access the Function constructor and execute arbitrary code in the server process. A single tools/call is sufficient to achieve full compromise.

Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to incorrect Access Control. The application fails to stop processing an incoming request in VuFind\Controller\AbstractBase::validateAccessPermission after it has found that controller level access permissions do not allow access to the requested function. The requester receives a response indicating that access was denied, but the actual function is executed regardless of that.

Nuxt before 3.3.1 in development mode exposes an unauthenticated RPC channel over the Vite HMR WebSocket. An attacker who can reach the HMR port can call methods like updateOptions() and openInEditor(), allowing arbitrary program execution on the developer's machine.

My Safetipin Android Application 5.2.1 contains hardcoded credentials in the authentication module, allowing remote attackers to bypass authentication and gain unauthorized access to user accounts via predictable OTP values.

boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users to inject arbitrary lines into the server's authorized_keys file. Attackers can insert a public key, gaining persistent shell access and reading credentials from the database.

GitHub Enterprise Server before version 3.22 has a path traversal vulnerability that allows an unauthenticated attacker to delete arbitrary files and directories on the instance, including the entire user storage directory containing Git LFS objects, release assets, attachments, and avatars. Exploitation of the X-GitHub-Request-Id header without sanitization as a filesystem path segment leads to data deletion.

PraisonAI before 4.6.40 contains a command injection vulnerability in the bundled Claude GitHub Actions workflow. The pull request branch name is embedded in a Bash block without validation, and any @claude comment can trigger the job, allowing outside contributors to execute arbitrary code in the runner.

In Jenkins 2.575 and earlier, and LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in Remoting deserialization. This allows agents, code on agents, and attackers with Agent/Connect permission to bypass the filter for classes on the Jenkins core classpath.

Vulnerability in Cisco Catalyst SD-WAN related to improper link resolution before file access (CWE-59). Discovered during internal security review, addressed in a software hardening release.

As part of an internal security review in Cisco Catalyst SD-WAN, multiple vulnerabilities related to improper access control (CWE-284) were discovered. A hardened software release addressing these issues has been issued.

Cisco Catalyst SD-WAN contains a vulnerability related to improper input validation (CWE-20). It was discovered during an internal security review and addressed in software hardening releases.

As part of an internal security review in Cisco IOS XE Software, multiple vulnerabilities related to improper neutralization of special elements (CWE-74) were discovered. Hardened software releases addressing these issues have been issued.

Vulnerability in Cisco IOS XE Software, discovered during an internal security review, involves improper access control issues classified under CWE-284. Hardened releases have been issued as a result.

A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perform privileged actions on the administrator's behalf.

An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged Hadoop role to escalate privileges and execute privileged operations against the Security database.

An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators.

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP request containing both Content-Length and Transfer-Encoding headers causes a reverse proxy and MarkLogic Server to interpret request boundaries differently.

An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges and execute privileged operations against the Security database.

An improper verification of cryptographic signature vulnerability in the SAML authentication module of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass authentication and impersonate any user, including administrators. This vulnerability affects deployments with SAML single sign-on enabled.

An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges to administrator. This enables execution of privileged operations and unauthorized data access.