CVE Vulnerability Catalog

Yamcs before version 5.12.7 has a server-side code injection vulnerability in the algorithm evaluation engine. An authenticated user with ChangeMissionDatabase privilege can override an existing algorithm via the REST API and inject Java code, leading to remote code execution on the host.

The Perl library Image::EPEG up to version 0.15 includes an unsupported version of the Epeg library (0.9.0), which has not been updated since 2004. Using outdated software may expose unpatched security vulnerabilities.

Kiota before versions 1.29.1 and 1.32.5 did not sanitize clientClassName and clientNamespaceName values from OpenAPI descriptions, allowing generated source to be written outside the output directory and arbitrary text to be injected into class or namespace declarations.

Kiota before versions 1.29.1 and 1.32.5 displayed dependency install commands from an OpenAPI description as recommended, allowing command injection when the suggested command was run manually or via the VS Code extension.

Kiota before versions 1.29.1 and 1.32.5 in plugin add and plugin generate commands did not validate paths in the static_template.file field, allowing path traversal or out-of-package file inclusion in generated plugin manifests.

The Microsoft 365 and Microsoft Entra ID Plugins for Moodle have a vulnerability in the Teams SSO endpoint (sso_login.php) that base64-decodes a JWT payload and authenticates users from the upn claim without verifying the JWT signature. An unauthenticated attacker can forge a token and obtain a Moodle session as an O365-authenticated user.

Kopia prior to 0.23.0, when the HTTP server is started with --without-password, accepts unauthenticated requests to /api/v1/repo/exists and forwards attacker-supplied SFTP storage configuration to blob.NewStorage. Setting externalSSH: true and sshArguments containing -oProxyCommand=<cmd> causes exec.CommandContext("ssh") to invoke the command through OpenSSH.

The vulnerability in SGLang involves an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface without authentication or deserialization safeguards. This allows an attacker to provide a malicious pickle file, resulting in unauthenticated remote code execution when the feature is enabled and the service is reachable over the network.

An input validation vulnerability in ubuntu-pro-client (formerly ubuntu-advantage-tools) allows injection of arbitrary APT repository configurations and installation of malicious packages with root privileges. The issue stems from missing validation of contract server data used to generate APT source files and execute apt-get install commands.

An unauthenticated remote attacker can execute remote code due to improper sanitization of user input in the SetParameter command.

An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the origin of a communication channel.

An authentication bypass vulnerability due to a primary weakness in Spring Authorization Server. Affects versions from 7.0.0 to 7.0.4, from 1.5.0 to 1.5.6, from 1.4.0 to 1.4.9, and from 1.3.0 to 1.3.10.

Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 lack proper TLS hostname verification. An attacker with on-path network access could intercept or redirect HTTPS traffic and present a certificate signed by any trusted CA for any domain, causing the connector to accept connections without validating the certificate matches the requested hostname.

The Happy Coders OTP Login for WooCommerce plugin before version 2.8 does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifier. This allows unauthenticated attackers to log in as any existing user, including administrators, and to create new accounts.

The SAML Single Sign On – SSO Login plugin for WordPress up to version 5.4.3 contains an authentication bypass vulnerability due to SAML signature algorithm confusion. The `Mo_SAML_Utilities::mo_saml_cast_key()` function reads the `SignatureMethod` algorithm attribute directly from the attacker-controlled `SAMLResponse` parameter instead of enforcing the locally configured algorithm, allowing the attacker to recast the IdP's RSA public key as an HMAC-SHA1 shared secret and validate a forged signature.

Wekan before version 9.46 has a vulnerability in the header-login mechanism where getRequestIp() trusts the client-supplied X-Forwarded-For header before the real socket address. This allows an unauthenticated attacker to impersonate any user, including admin, by sending a HEADER_LOGIN_ID header and obtaining a meteor_login_token session.

A vulnerability in Qinglong before version 2.20.1 allows an unauthenticated attacker to reset administrator credentials. The init guard middleware does not cover the /open/user/init path, which is rewritten after JWT authentication, enabling an attack via a PUT request.

WWBN AVideo before version 29.0 contains a stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin. An unauthenticated remote attacker can execute arbitrary JavaScript in the context of an administrator viewing the online users debug panel.

In Wekan prior to version 9.32, the Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing accounts when the OIDC email or username matches an existing Wekan user, without verifying ownership or checking email_verified. An attacker using an OIDC provider account with a victim's email or username can cause Wekan to merge the attacker's OIDC credentials into the victim account and then log in as that account.

Wekan before version 9.07 has a command injection vulnerability in the avatar upload functionality. User-supplied filenames are passed to child_process.exec() without sanitization, allowing shell metacharacters like backticks and $() to execute arbitrary commands on the server.