CVE Vulnerability Catalog

In Goobi viewer before version 26.05, when a password reset link is visited, the application generates a replacement password in a predictable way and emails it to the account holder. The insufficient entropy allows the password to be brute-forced by an attacker who can approximate the server-side generation time.

In Goobi viewer before version 26.05, the password reset token is predictably based on the time of the reset request. An attacker who knows the target's email address can request a reset and then brute-force the token. Exploiting this finding alone forces an unauthorized password reset on any account.

In Cacti prior to version 1.2.31, the prior blocklist ([;&| `$\n\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string containing these characters and bypass the check.

In obsidian-tc from 1.0.1 until 1.31.4, the create_entity, link_entities, rename_entity, unlink_entities and delete_entity tools regenerate memory notes from SQLite at the computed memory/<type>/<name>.md path without reliably preserving note ownership, so a hand-authored note or an orphan from another entity sanitizing to the same path could have its entire body overwritten. Additionally, several tools mutate SQLite before fallible filesystem work, so a later filesystem failure can leave the memory graph inconsistent with notes on disk even when the operation failed.

In obsidian-tc from 1.13.0 until 1.31.4, a Streamable HTTP deployment with `auth.jwtSecret` configured allowed bypassing human confirmation for dispatch-gated destructive tool calls. The server trusted a validly bound `requestState` as proof of approval even though that state was minted before the `elicitation/create` leg and only proved the resubmission belonged to the same call. A misbehaving or attacker-controlled client could therefore execute destructive vault operations without human approval while still requiring the caller's ordinary tool permissions.

GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored by ReportScheduling.btnSaveReport_Click() without output encoding and is executed in the browser of the user who created the scheduled report when they subsequently view the MailInsights page.

A vulnerability in @rog0x/mcp-docker-tools version 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.

A vulnerability in @rog0x/mcp-git-tools version 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.

A vulnerability in @justice8096/sagemath-mcp-server version 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.

The Joomla extension Phoca Gallery versions 4.5.0 to 6.1.5 contains a stored cross-site scripting (XSS) vulnerability through HTML attribute injection, exploitable by an authenticated user.

A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wrapper forwards them to Unbound without restricting the configuration path. This can disclose password hashes and private keys and corrupt privileged configuration files.

A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The configuration can add an attacker-controlled domain to the proxy allowlist of the default class of service; if a signed-in user opens a crafted /service/proxy URL, Zimbra serves attacker-controlled HTML under its own origin, enabling mailbox data theft and authenticated actions as the victim.

A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that inserts the parameter into a hidden input attribute without HTML encoding. A victim who opens the URL receives attacker-controlled script and page content under the legitimate Zimbra origin, allowing credential capture through a replacement login form.

An LDAP filter injection vulnerability in Zimbra Collaboration Suite allows an authenticated user to query otherwise unreturned attributes of calendar resources through SearchCalendarResourcesRequest. Zimbra escapes search values but inserts the supplied attribute names directly into LDAP filter expressions without validation. An attacker can inject additional conditions and use repeated matching queries to recover readable resource attributes such as internal mailbox hostnames and mail transport routes.

A cross-account authorization vulnerability in Zimbra Collaboration Suite allows an authenticated user to insert forged shared-file records into another user's mailbox through FileSharedWithMeRequest. The request bypasses delegated-account authorization and accepts attacker-selected file metadata, owner identifiers and declared sizes without validating a corresponding document share. An attacker can plant entries attributed to another real local account without that account sharing a document. No victim interaction is required.

A CSS sanitization vulnerability in Zimbra Collaboration Suite allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content under the Zimbra origin. When processing a stylesheet containing non-ASCII characters, DefangFilter appends the final ASCII segment without sanitizing it. HTML stored as application/x-zimbra-doc can therefore retain CSS URL references that the normal sanitizer removes. An attacker can share a crafted document that loads external resources and displays a credential-collection form using Zimbra's own visual assets.

A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating Zimbra session and selects the destination mailbox from the browser's current authentication cookie. An attacker can induce a signed-in victim to load a callback with a fresh code for the attacker's account, creating a persistent data source that imports attacker-controlled contacts or events; with bidirectional CalDAV synchronization, calendar appointments are also disclosed.

A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite allows an unauthenticated sender to bypass the restriction on forms that target the Zimbra host. DefangFilter and the OWASP ActionAttributePolicy compare the form-action hostname with the request hostname before browser URL canonicalization. A percent-encoded hostname can therefore survive sanitization while the browser submits the form to the normal Zimbra origin with the recipient's authentication cookie. This permits authenticated form requests from a crafted email after the recipient opens it in Classic and submits the form.

An organizer authentication vulnerability in Zimbra Collaboration Suite allows an unauthenticated email sender to insert calendar invitations attributed to another user. The email delivery path permits external invitations but does not verify that the message sender is authorized to use the iCalendar ORGANIZER identity. When automatic invitation insertion is enabled, a crafted REQUEST component creates an event containing attacker-selected meeting details and reminders under a forged organizer without recipient interaction. No corresponding event is created in the claimed organizer's calendar.

An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite allows an unauthenticated sender to forge another attendee's response to an existing meeting. Zimbra passes a null sender identity when processing iCalendar REPLY components, causing the attendee authorization filter to be skipped. An attacker who knows the meeting UID, organizer address and attendee address can send a non-outdated reply that changes the attendee's participation status in the organizer's calendar. The change occurs automatically during delivery without organizer or attendee interaction.