CVE Vulnerability Catalog

The HTTP::Daemon library for Perl before version 6.17 has an OS command injection vulnerability in the send_file() function. It opens its string argument with Perl's 2-arg open(), which interprets magic prefixes like '| cmd' as a pipe to a subprocess, allowing arbitrary command execution.

Cross-Site WebSocket Hijacking vulnerability in Dozzle prior to 10.5.2. The WebSocket upgrader for /exec and /attach endpoints accepts requests from any origin, and the JWT cookie uses SameSite: Lax. An attacker on the same site (e.g., a subdomain) can hijack the WebSocket session and gain interactive shell access to a container.

GitLab MCP Server before version 0.6.0 lacks authentication in HTTP transport and uses Access-Control-Allow-Origin: *, allowing anyone to access the RPC endpoint with full access to the GitLab personal access token. The server listens on all network interfaces.

Lumiverse prior to 0.9.7 has a vulnerability in the component override system that transpiles TSX via Sucrase and executes it with new Function, shadowing dangerous globals. Static protection and shadowing are bypassed by reconstructing identifiers from string fragments and DOM sandbox escape. A malicious theme pack (.lumitheme) can execute code in an authenticated user's session.

Vulnerability in Lumiverse (AI chat app) before version 0.9.7 allows a logged-in user to execute arbitrary code on the server via the MCP server creation endpoint. The attacker can use -e or -c flags in args, leading to remote code execution. The server listens on all interfaces and host-header rebinding protection is easily bypassed.

Lumiverse before version 0.9.7 contains a command injection vulnerability in the SMB path handling function. When the primary toSmbPath method fails, the code uses an unvalidated basename in the smbclient script, allowing arbitrary command execution via injection of ';' separator or '!cmd' local escape.

Vulnerability in Lumiverse – the Spindle extension build pipeline runs `bun install` without `--ignore-scripts`, allowing a malicious extension to execute host-level code before security scanning. Fixed in version 0.9.7.

FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class. Five methods use an incorrect bounds check, allowing writing exactly one byte past the end of the heap-allocated buffer. An attacker sending network traffic (NetFlow, sFlow, IPFIX, or BGP) can trigger this overflow, potentially achieving arbitrary code execution.

IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an unauthenticated remote attacker to update server property files that would allow them to gain unauthorized access to the application.

IBM HTTP Server versions 8.5 and 9.0 are vulnerable to denial of service and potential remote code execution due to improper input validation.

A remote code execution vulnerability in IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty (versions 8.5, 9.0) allows an attacker to execute arbitrary code via a specially crafted request.

In Eppendorf BioFlo 320, a vulnerability exists due to a hard-coded password in the VNC server. A remote attacker knowing the network address can gain full control of the user interface.

Improper token validation vulnerability in Kavita prior to 0.9.0.2. A remote, unauthenticated attacker can obtain a JWT for any user (including admins) given knowledge of their username.

Critical Remote Code Execution (RCE) vulnerability in Twenty CRM (versions 1.7.7 through 1.16.7) via a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack. An authenticated attacker can execute arbitrary OS commands on the database server by injecting SQL through the unsanitized timeZone parameter in the REST API groupBy endpoint.

In FACTION prior to 1.8.3, AccessControlInterceptor unconditionally calls invocation.invoke() without checking for a valid session. Four action methods in BoilerPlateConfig perform no local session check either, allowing an unauthenticated attacker to read, overwrite, deactivate, and permanently delete any boilerplate template in the system.

Vulnerability in Joomla! due to improper access control in the com_users group editing webservice endpoint. Allows privilege escalation.

The password and username reset features created plain HTTP links for HTTPS connections if the "Force SSL" flag wasn't explicitly set.

An improper access check allows privilege escalation through the com_users batch task.

An improper access check in the com_users batch task allows privilege escalation.

Integer overflow in FastNetMon Community Edition up to 1.2.9 in the BGP AS_PATH attribute encoder leads to a heap buffer overflow.