CVE Vulnerability Catalog

Navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted file names in suggestion command directories to execute arbitrary commands with victim privileges.

Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark the inflated order as fully paid while the gateway captured only the original amount.

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API resolves to that administrator, granting full administrative access.

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for known administrator email addresses with forged Host headers to intercept valid reset tokens and take over administrator accounts.

Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in 'clear cache' task in Event Gallery extension < 6.5.0 - Using the 'images' parameter of the 'cache.process' task, you can recursively delete any directories that the web server is authorized to write to.

Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0

MatchTrustedPeer ignores the public key used, allowing forged CA clones to pass verification. Affected builds enable WOLFSSL_TRUST_PEER_CERT and load CA certificates via wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert(). The peer must know the loaded certificates to exploit the issue.

When using RPK, the client side of TLS 1.2, 1.3 and DTLS 1.2 connections could accept an unsolicited server_cert_type=RawPublicKey, allowing a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in specific builds.

A vulnerability in wolfSSL when WOLFSSL_SMALL_CERT_VERIFY is enabled allows an attacker to bypass certificate signature verification. Due to incorrect result merging, parse errors hide invalid signatures, and date/constraint checks are performed before signature confirmation. An attacker can use a self-signed certificate with arbitrary signature bytes to pass verification if the application uses a callback that overrides date errors.

The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perform an authorisation check on one of its AJAX actions, allowing users with a subsite administrator role on a multisite network to write and delete arbitrary files in the network's shared filesystem, which can lead to remote code execution.

The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators. This affects the commercial Pro edition only; the free Download Manager WordPress plugin before 7.5.6 published under the same slug does not ship the affected feature.

The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged-in user under a configuration its own settings allow, and does not filter the content saved there. This allows users with a role as low as subscriber to store code which is then executed as PHP or served unescaped to site visitors.

A vulnerability in coollabsio Coolify up to 4.1.0 affects the Github::redirect function in /webhooks/source/github/redirect of the GitHub App Setup Handler component. Manipulation of the state argument results in missing authentication. The attack can be executed remotely, and the exploit has been made public. Version 4.1.1 mitigates the issue.

Vulnerability in Heym before 0.0.53 where workflow condition expressions are evaluated using Python's eval() with insufficient sandboxing in the workflow executor service.

heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access to access os.system and execute commands as the backend process.

AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString() method that fails to sanitize Liquidsoap string interpolation sequences. Authenticated users with Media or Profile permissions can inject arbitrary Liquidsoap code into station configuration, leading to shell command execution as the azuracast user when the station restarts.

AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute arbitrary code in the Liquidsoap process, disclose internal API keys, or disrupt station operation.

Command injection vulnerability in AzuraCast before 0.23.8 in Liquidsoap config generation for live recording, due to failure to quote streamer username in process.run calls.

AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/{id}/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. Attackers with View-only access can call this endpoint and receive plaintext frontend credentials in the JSON response, then use the admin password to authenticate to the Icecast admin interface without Broadcasting permission.