CVE Vulnerability Catalog

Apache Thrift C++ bindings (versions before 0.25.0) contain a missing release of memory after effective lifetime vulnerability. This can lead to gradual memory resource exhaustion.

Apache Thrift PHP bindings (versions before 0.25.0) contain an allocation of resources without limits or throttling vulnerability. This can lead to server resource exhaustion.

Apache Thrift C++ WebSocket server (versions before 0.25.0) contains a use of uninitialized resource and return of wrong status code vulnerability. This can lead to unpredictable application behavior.

All Apache Thrift JS bindings (versions before 0.25.0) are vulnerable to prototype pollution through improperly controlled modification of object prototype attributes. This can lead to unexpected JavaScript application behavior.

The C++ and D libraries of Apache Thrift contain a certificate validation flaw where, upon a host name mismatch, subjectAltName dNSName entries are checked first and the Common Name is consulted afterwards despite the presence of dNSName entries. A non-matching dNSName yields a "skip" result instead of rejection, allowing a certificate with a matching Common Name to be accepted. This affects the C++ library from 0.7.0 through 0.24.0 and the D library from 0.9.0 through 0.24.0.

Apache Thrift Python bindings (versions before 0.25.0) contain improper certificate validation and return of wrong status code vulnerabilities. This can lead to accepting invalid certificates and communication errors.

Apache Thrift Perl bindings (versions before 0.25.0) contain improper certificate validation and initialization of a resource with an insecure default vulnerabilities. This can lead to establishing insecure connections.

YesWiki before 4.5.3 contains multiple reflected cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure users into opening crafted links to hijack sessions and trigger authenticated requests.

YesWiki before 4.6.7 contains a server-side request forgery (SSRF) vulnerability that allows page editors to make the server fetch arbitrary URLs via the url parameter of the Bazar valeur action. Attackers can embed the action with a champ parameter in wiki markup to reach loopback or internal services and partially read responses rendered into the page.

YesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions because login does not regenerate the PHP session ID. Attackers who set or learn a victim's pre-authentication YesWiki-* session cookie can reuse it after login to access private content and perform actions with the victim's privileges.

YesWiki before 4.6.7 contains an insufficient session expiration vulnerability because password reset tokens lack expiry timestamps. An attacker who obtains an unused reset URL from mailboxes, logs, backups, or browser history can submit a new password through checkEmailKey() and take over accounts.

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php. Users who can edit pages or post comments can inject event handlers by placing quotes in markdown image URLs, leading to JavaScript execution in viewers' browsers, including administrators.

YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail handler. An attacker can craft a link whose field value breaks out of the ajax-mail-form action attribute, executing JavaScript in the victim's browser.

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile. SVG files are stored verbatim and served inline as image/svg+xml, allowing authenticated users to upload SVG files containing script that executes in the wiki origin when opened.

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. An attacker can POST a crafted actor_handle with a numeric host and port to the abonnements view to probe internal HTTPS services and ports.

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. An attacker can send a crafted Signature keyId to the public actor inbox route to reach cloud metadata, loopback services, or internal hosts.

YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. An attacker can request the xml method of a page hosting the action to retrieve 500-character body excerpts of every latest page, including read-restricted drafts and notes.

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool.

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators to crafted GET links. An attacker can supply a wide id range in the delete_tag parameter via top-level navigation, carrying the SameSite=Lax admin cookie, to bulk-delete tag triples.

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. An attacker can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, or emptytrash, deleting or permanently purging the page's attachments.