CVE Vulnerability Catalog

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications. In versions prior to 1.24.0, the Container Executor path allowed users to supply pod specifications directly, which could lead to unauthorized access to resources.

Fission is a serverless framework, native to Kubernetes, that simplifies the deployment of functions and applications. Prior to version 1.24.0, the lack of validation in Environment.spec.runtime.podSpec / spec.builder.podSpec led to the propagation of dangerous fields into generated pods.

Fission, a serverless framework for Kubernetes, prior to version 1.23.0 registered internal routes for function objects, allowing them to be invoked without proper permissions. This enabled attackers to call functions by guessing their names and namespaces.

A flaw was found in assisted-migration-agent that allows an unauthenticated attacker on the same local area network to exploit a path traversal vulnerability. By crafting a specially designed gzipped tarball, the attacker can bypass security checks and write arbitrary files to the system.

A flaw was found in assisted-migration-agent that hardcodes insecure TLS connections when communicating with vCenter. This vulnerability allows a Man-in-the-Middle (MITM) attacker to intercept and harvest vCenter administrator credentials.

A flaw was found in migration-planner that allows a remote authenticated attacker to upload a specially crafted RVTools .xlsx file. Due to improper input sanitization, malicious SQL embedded within spreadsheet cells is executed when processing cluster names.

A flaw exists in the migration-planner where the agent-API middleware fails to properly validate the source_id claim in JWTs. This allows an authenticated attacker to manipulate data across different tenants, leading to a complete collapse of tenant isolation.

A flaw was found in migration-planner that allows an authenticated attacker to bypass access control in the `/api/v1/sources/{id}/image-url` endpoint. This flaw enables the attacker to obtain presigned S3 URLs for OVA images belonging to other users.

A flaw was found in migration-planner that allows an authenticated user to send a DELETE request to the /api/v1/sources route, which lacks proper authorization and filtering. This enables the destruction of all customer data, including sources, agents, and assessments.

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the HAProxy section-save endpoints accept an unvalidated JSON option field, allowing arbitrary HAProxy directives to be injected into the configuration.

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the config_file_name field in the POST request /waf/<service>/<server_ip>/rule/<rule_id>/save is not properly validated, allowing an attacker to write files to any location on the load balancer's filesystem.

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the lack of proper decorators in certain endpoints allows any logged-in user, including the default guest role, to install and reconfigure exporters, WAF, and GeoIP databases on all servers in the Roxy-WI database.

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the PUT /smon/check functionality does not verify if the check_id belongs to the user's group, allowing unauthorized modifications to other users' monitoring settings.

The Doctreat Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 1.6.8. The doctreat_process_registration() function does not properly restrict the roles that a user can register with.

The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any file type accepted by WordPress's media library through endpoints that should only accept images or videos.

Buffer overflow in File Station 5 allows a remote attacker to modify memory or crash processes. The vulnerability is fixed in version 5.5.6.5243 and later.

Buffer overflow in File Station 5 allows a remote attacker to modify memory or crash processes. The vulnerability is fixed in version 5.5.6.5243 and later.

The vulnerability affects QTS (QNAP operating system). The vendor confirms QuTS hero is not affected. The fix is included in QTS 5.2.7.3256 build 20250913 and later.

Espressif IoT Development Framework (ESP-IDF) versions 5.5.4 and 6.0 have a vulnerability in the esp_tee component that exposes secure-service wrappers. An attacker can exploit these wrappers to gain unauthorized access to TEE-protected peripherals.