CVE Vulnerability Catalog

NT OneAPP by NewType Infortech contains a hard-coded credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information.

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host.

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (utils/modcss action). The fetched stylesheet was read into memory in full with no size limit and no read timeout, allowing server memory exhaustion via an attacker-controlled stylesheet URL.

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48, and the unspecified address ::/128, allowing URLs such as http://[64:ff9b::7f00:1]/ to reach loopback, link-local, and cloud metadata addresses.

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; thus markup in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute”.

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. The parser repeatedly re-processes the same bytes without making progress, and the thread stays busy at 100% CPU even after the client disconnects.

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping does not check for a short read, causing the H2 multiplexer tasklet to be repeatedly woken without progress and high CPU usage.

The Drupal Webform module contains an Incorrect Authorization vulnerability that allows Forceful Browsing. The issue affects versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.

The Drupal AI CKEditor module contains a code injection vulnerability due to improper neutralization of special elements used in a template engine. This issue affects AI CKEditor versions from 0.0.0 to 1.4.3.

A missing authorization vulnerability in the Drupal Webform REST module allows forceful browsing. This issue affects Webform REST versions from 0.0.0 to 4.2.1.

The Drupal module Editoria11y Accessibility Checker contains a Privilege Defined With Unsafe Actions vulnerability that allows privilege escalation. This affects versions from 0.0.0 to 2.2.23 and from 3.0.0 to 3.0.9.

The Drupal Tawk.to - Live chat application module contains a Cross-Site Request Forgery (CSRF) vulnerability that may allow unwanted actions on behalf of a logged-in user. The issue affects versions from 0.0.0 to 3.0.4.

The Drupal Stop administrator login module contains an authentication bypass using an alternate path or channel. This issue affects Stop administrator login versions from 1.0 to 1.6.

The Drupal Smart Content module contains a Missing Authorization vulnerability that allows Forceful Browsing. The issue affects versions from 0.0.0 to 3.2.1.

The Drupal REST & JSON API Authentication module contains an Authentication Bypass Using an Alternate Path or Channel vulnerability that allows bypassing authentication. The issue affects versions from 0.0.0 to 3.2.0.

The Drupal Mermaid Diagram Field module contains an incorrect authorization vulnerability allowing forceful browsing. This issue affects Mermaid Diagram Field versions from 1.0.4 to 1.0.9.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Diba carousel slider allows Stored XSS. This issue affects Diba carousel slider versions from 0.0.0 to 3.0.2.

The Drupal module CSS Usage Analyzer contains a Missing Authorization vulnerability that allows forceful browsing. This affects versions from 1.0.0 to 1.0.2.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CookieCuttr allows Stored XSS. This issue affects CookieCuttr versions from 2.0.0 to 2.0.3.

The Drupal Commerce Decoupled Checkout module contains an improperly controlled modification of dynamically-determined object attributes vulnerability allowing object injection. This affects versions 1.0.0 through 1.8.0.