CVE Vulnerability Catalog

Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled server_id and loads the server without restricting the lookup to servers owned by the authenticated account. On installations with billing enabled, an authenticated user can renew or unsuspend another tenant's billable server when its renewal_date is non-null and more than seven days away, even without a subuser relationship to that server. This issue is fixed in version 4.0.5.

Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the user's security token, and omits the table returned by getDataSource(). If one request first checks a table allowed to the user and then a different denied table, the voter can reuse the allowed result, while DefaultDataContainerVoter can convert an incorrect abstention into a grant. A low-privileged backend user can consequently read, create, update, or delete records in tables outside assigned module permissions, including tables containing member or newsletter-subscriber data. This issue is fixed in version 5.7.12.

Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter although the shipped class is PreviewVoter. Symfony therefore omits voter autoconfiguration and removes the private service, so PreviewVoter::hasAccess() never enforces ownership. A non-admin backend user with the preview_link module can list every tl_preview_link record, obtain signed share URLs created by other users, and use them to view unpublished pages with showUnpublished despite lacking page permission. The advisory does not establish editing or deletion of foreign links. This issue is fixed in version 5.7.12.

Contao, an Open Source CMS, versions 5.0.0 through 5.3.50 and 5.7.12, has a vulnerability in ImagesController that joins the user-controlled {path} parameter to the image target directory without verifying the canonical path stays within that directory. An unauthenticated attacker can use encoded parent-directory segments to access files under the project directory if their extensions are allowed. This issue is fixed in versions 5.3.50 and 5.7.12.

Contao, an Open Source CMS, versions 4.1.0 through 5.3.50 and 5.7.12, has a vulnerability in ModuleRegistration::compile() that allows the follow-up registration branch to be entered on any POST to a page with the registration module without verifying FORM_SUBMIT or the captcha result. resendActivationMail() can then invoke OptInToken::send() without rate limiting, allowing an unauthenticated attacker to send repeated activation emails and determine if a pending registration exists. This issue is fixed in versions 5.3.50 and 5.7.12.

Contao, an Open Source CMS, versions 4.0.0 through 5.3.50 and 5.7.12, has a vulnerability in ModuleSearch that can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.index_protected is changed from enabled to disabled. Authorization metadata is stored per row in tl_search, but disabling the setting removes the protected-row filter without deleting rows indexed while protection was enabled. This issue is fixed in versions 5.3.50 and 5.7.12.

AWS Amplify API Category before version 3.1.2 has a vulnerability in the query resolvers generated by @aws-amplify/graphql-index-transformer that might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in @aws-amplify/graphql-index-transformer 3.1.2.

pacioli, a least-privilege governance tool for ERPNext, versions 0.9.6 through 0.10.0, has a vulnerability in the pacioli-guard document-layer consent gate that allows nested cancellation operations to ride any consent established by an enclosing governed act without checking whether the marker authorizes cancellation. A credential with API Key Scope.require_consent can submit a caller-controlled document under a valid marker and reach Document.cancel() for a different pre-existing document, bypassing the marker's binding, single-use spend, and denial audit. This issue is fixed in version 0.10.0.

OWASP Coraza WAF, a golang modsecurity compatible web application firewall library, prior to 3.8.1, has a vulnerability in internal/cookies.ParseCookies that handles boundary ASCII control characters and control-only or empty cookie names differently from several backend cookie parsers. An unauthenticated attacker can craft a Cookie header so Coraza indexes or drops a cookie under a different name or value from the backend application, causing rules targeting REQUEST_COOKIES or REQUEST_COOKIES_NAMES to miss application-visible attacker data. This issue is fixed in version 3.8.1.

OWASP Coraza WAF, a golang modsecurity compatible web application firewall library, versions 3.0.0 through 3.8.0, has a vulnerability in the multipart loop in internal/bodyprocessors/multipart.go that executes defer temp.Close() for every uploaded file part, so each temporary-file descriptor remains open until the complete request returns. An unauthenticated attacker can submit a multipart body containing many minimal file parts and exhaust the process file-descriptor table within the request-body size limit, causing os.CreateTemp failures, MULTIPART_STRICT_ERROR responses, blocked legitimate uploads, and process-wide inability to open files or sockets. This issue is fixed in version 3.8.0.

OWASP Coraza WAF, a golang modsecurity compatible web application firewall library, versions 3.0.0 through 3.8.0, has a vulnerability in ProcessResponse in internal/bodyprocessors/json.go that passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can cause an application protected by Coraza to return deeply nested JSON can make response-body processing perform quadratic work, consuming one CPU core for seconds per response within the default ResponseBodyLimit. This issue is fixed in version 3.8.0.

OWASP Coraza WAF, a golang modsecurity compatible web application firewall library, versions 3.0.0 through 3.8.0, has a vulnerability in ProcessURI in internal/corazawaf/transaction.go that handles a url.ParseRequestURI failure by retaining the raw URI but leaving QUERY_STRING, ARGS_GET, ARGS_GET_NAMES, and the GET-derived portion of ARGS empty. An unauthenticated attacker can place control bytes in a URI passed directly by integrations such as coraza-spoa, coraza-proxy-wasm, custom FFI hosts, or WASM hosts, causing Coraza to omit query parameters that the downstream integration may still process and allowing rules targeting those variables to be bypassed. This issue is fixed in version 3.8.0.

MariaDB server, a community developed fork of MySQL server, versions 10.6.1 through 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, has a vulnerability in the ACL cache that could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

x64dbg-MCP Server before version 1.2 has an integer overflow vulnerability in parseContentLength() and wsRecv(), allowing an unauthenticated network client to trigger a panic and terminate the x64dbg process. The server listens on 0.0.0.0 by default, increasing attack surface. Fixed in version 1.2.

MariaDB Connector/C from 3.4.1 to 3.4.10 has a vulnerability in the SSL authentication-switch logic that fails to reject TLS hostname mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker could obtain the database password.

MariaDB server versions from 10.6.1 to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 have a vulnerability in the mysql_json plugin that assumes imported MySQL tables contain valid binary JSON. A specially crafted table with invalid JSON can cause out-of-bounds reads, information disclosure, or server crash.

MariaDB server versions from 10.6.1 to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2 have a vulnerability in the qc_info plugin that can be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server.

Vulnerability in pyLoad where the `/web/<path:filename>` route renders Jinja2 templates without authentication. An exception attribute typo leaks internal Jinja2 variable names in HTTP 500 responses.

Vulnerability in pyLoad where the API `rpc` function reads the entire uploaded file into memory without a size limit, potentially exhausting server memory and terminating the process.

The FV Flowplayer Video Player WordPress plugin (up to version 7.5.54.7212) fails to properly neutralize input during web page generation, enabling Stored XSS. Malicious JavaScript can be persistently stored and executed in a user's browser.