CVE Vulnerability Catalog

The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.

In CTFd Terraform Provider, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team password without an additional decryption step.

Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to another application by the same identity provider.

A double free in XKB SetGeometry in X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially execute code in the X server context.

Tanium addressed a denial of service vulnerability in Provision. Technical details of the vulnerability were not provided in the description.

Tanium addressed a SQL injection vulnerability in Provision.

Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use setChannelVar to execute write dialplan functions, including FILE() writes, even when live_dangerously in asterisk.conf is set to no. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid read-only ARI credentials; HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled.

Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a stack buffer overflow in res_xmpp XMPP namespace prefix handling using carefully crafted packets. The res_xmpp module must be loaded, an XMPP connection must be configured in xmpp.conf, and the attacker must have an XMPP account on the same or a federated server.

Grafana's RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder.

NextChat version 2.16.1 contains a client-side cross-site scripting (XSS) vulnerability in the Plugin Editor due to unsafe rendering of externally supplied OpenAPI plugin schema content. Content loaded from a remote URL is stored in plugin.content and rendered via React's dangerouslySetInnerHTML without proper sanitization, allowing arbitrary JavaScript execution in the NextChat origin.

GnuPG version 2.5.21 for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories under this path. A low-privilege attacker can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components.

In reduxjs redux-devtools 5.0.0, the evalAction function of the Remotedev Server component allows code injection through manipulation of the action argument. The attack is only possible with local access, and the exploit has been made public.

A weakness was identified in oretnom23 php-travel-agency-system in an unknown function of contact_insert.php in the Contact Form Handler component. Manipulation of the name/company/email/topic/phone/comments arguments causes SQL injection, the attack can be initiated remotely, the exploit has been made public, and the project has not responded to the issue report.

A security flaw was discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635 in an unknown function of traceapplication.php. Manipulation of the Search argument results in SQL injection, the attack can be launched remotely, the exploit has been released to the public, and the project has not responded to the issue report.

Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go in FileBrowser Quantum resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user's authorized scope. Download, preview, media, OnlyOffice, and public-share read flows that enable FollowSymlinks can therefore serve an out-of-scope target through a reachable in-scope symlink; an authenticated user with download access can read server-accessible files outside the assigned scope, and a holder of a public share link can do the same without an account when the shared directory exposes such a symlink.

Prior to version 0.27.0, HomeBox validates generic notifier URLs with ValidateNotifierURL, but shoutrrr sends requests through http.DefaultClient.Do without a CheckRedirect policy that revalidates each Location target. An authenticated collection member can configure a permitted notifier host that redirects to loopback, link-local, cloud metadata, or another blocked destination.

From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicit_hosting enabled incorrectly authorize legacy WebRTC data-channel input because LegacyIsHost() evaluates host status incorrectly. An authenticated room member can send mouse and keyboard events through the legacy control channel while controls are locked.

Prior to version 1.37.0, Vaultwarden validates the initial icon host and DNS results but passes favicon URLs parsed from attacker-controlled HTML to get_page_with_referer() without applying should_block_host() to the second-stage host. A remote unauthenticated attacker can provide a public page whose favicon uses an IP-literal URL, allowing the Vaultwarden server to reach loopback or private and internal addresses.

From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca/<integer-id>/crl endpoint in OpenWISP Controller allows an authenticated organization manager with CA view permission to retrieve another organization's certificate revocation list by requesting its sequential CA identifier. CrlDownloadView.retrieve resolves the CA directly instead of using the organization-scoped object retrieval enforced by FilterByOrganizationManaged.

Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Join and executed through sh -c. An authenticated contributor can include shell metacharacters in the workspace name, causing arbitrary commands to execute as the Atlantis service account. The issue is fixed in version 0.47.1.