CVE Vulnerability Catalog

In Fleet prior to version 4.81.0, metadata from software packages (.pkg, .deb, .rpm, .exe, .msi) is not properly sanitized before being included in generated uninstall scripts. A crafted package with malicious metadata values can cause arbitrary command execution as root (macOS/Linux) or SYSTEM (Windows) on managed endpoints when uninstall is triggered.

SiYuan is a knowledge management system that prior to version 3.7.0 did not properly HTML escape names and versions in plugin.json files. As a result, malicious HTML could be executed in the user interface when a user opened the marketplace tab.

SiYuan is an open-source personal knowledge management system. In versions prior to 3.7.0, attribute view names are stored without HTML escape, leading to potential HTML injection and Node.js code execution in the renderer.

Gradient is a nix-based continuous integration system. In version 1.1.0, when GRADIENT_DISCOVERABLE=true, anyone who can reach /proto can register as a worker without any credentials, leading to unauthorized access to jobs from every organization.

SiYuan is a knowledge management system that prior to version 3.7.0 had an issue with handling the aria-label attribute. Due to improper URL decoding, it was possible to inject malicious HTML code, leading to unauthorized script execution.

The Note Mark application prior to version 0.19.4 does not enforce minimum length or entropy for the JWT_SECRET configuration value. It allows any base64-decodable secret, including secrets as short as 1 byte.

mdserver-web versions from 0.18.0 to 0.18.4 have an unauthorized remote command execution vulnerability in the /modify_crond and /start_task interfaces. The lack of authentication allows modification of default scheduled tasks and their execution, leading to RCE.

FileBrowser Quantum prior to versions 1.3.1-stable and 1.3.9-beta has a vulnerability that allows an attacker to use attacker-controlled path input to escape the intended shared directory. As a result, an unauthenticated attacker with a valid public share hash and delete permissions can delete arbitrary files outside this directory.

Microsoft Authenticator has a vulnerability that allows an unauthorized attacker to disclose sensitive information over a network.

Valtimo is a business process automation platform with a vulnerability that allows remote code execution and credential exfiltration. Versions from 12.0.0 to before 12.32.0 for com.ritense.valtimo:document and from 13.0.0 to before 13.23.0 for com.ritense.valtimo:case and com.ritense.valtimo:contract are affected.

Gotenberg is an API for PDF files that prior to version 8.31.0 had a vulnerability in the downloadFrom and webhook features. The default deny-lists were bypassable, allowing unauthenticated attackers to access internal HTTP services.

Gotenberg is a PDF file API that, prior to version 8.31.0, did not validate keys in JSON objects sent to the /forms/pdfengines/metadata/write endpoint. Using a newline character in a JSON key allows for the injection of arbitrary ExifTool flags, leading to unauthenticated OS command execution.

A vulnerability in PyTorch Lightning versions 2.6.2 and 2.6.2 introduces functionality consistent with credential harvesting.

In the soundcloud-rpc application prior to version 0.1.8, a vulnerability allowed for local command execution on the user's machine through malicious SoundCloud track metadata. This metadata was trusted and forwarded to the Electron main process, enabling it to be rendered as raw HTML.

vCluster Platform prior to versions 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0 has a Stored XSS attack vulnerability via the name field of a templateRef. This can lead to the execution of arbitrary external scripts within the platform's browser context.

A vulnerability in Akilli Commerce software allows authorization bypass through a user-controlled key, leading to session hijacking.

There is an SQL injection vulnerability in Akilli Commerce software that allows for a Blind SQL Injection attack. This issue affects E-Commerce Website versions before 4.5.001.

The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 5.1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action.

The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation due to missing authorization in all versions up to and including 5.1.2. This is due to missing nonce verification and capability checks in the iwar_save_recipe() AJAX handler.