CVE Vulnerability Catalog

Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend connection where a victim completed an NTLM or Negotiate handshake, letting them read victim data and act as that victim.

Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider. The HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations, allowing unauthenticated attackers to access backends protected by auth-type, auth-url, or whitelist-source-range annotations with nothing logged.

Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certificates without presenting one.

WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL() because get_headers() follows redirects without re-validating targets with isSSRFSafeURL(). Authenticated uploaders can store a videoLink pointing to a redirector, causing internal GET requests when visitors view the video, enabling internal port scanning.

WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and accounts, or change and demote them.

In oretom23 php-travel-agency-system, admin/insert.php in the Insertion Handler is vulnerable to SQL injection via manipulation of the costomer_id, payment_type, amount, description, user, uploadimage, full_name, and visa_no arguments. The attack can be launched remotely, a public exploit is available, and the project has not responded to the report.

In Linksys RE6250 1.0.04.001, the strcmp function of the Web Management Interface is affected: manipulation of the session_id argument leads to insufficiently random values. The attack may be initiated remotely, though complexity is high and exploitability is difficult. The exploit has been publicly disclosed and may be used.

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the instance-wide SAML or LDAP membership lock was enabled, an authenticated user could have granted or accepted project and group membership outside the identity provider's control, due to incomplete enforcement of the membership lock on requests created before the lock was enabled.

GitLab CE/EE versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 contain improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking. When OmniAuth SAML and LDAP auto-linking are both enabled, an authenticated user can take over an existing LDAP-backed account without victim interaction.

GitLab has remediated an issue in GitLab EE affecting versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could allow an authenticated user to bypass a required merge request approval policy on a protected branch due to improper access control during approval rule synchronization.

GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 could have allowed an authenticated user to read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects across the instance without any project membership. The cause was missing authorization checks on a user-supplied project filter parameter in the group milestones API.

GitLab CE/EE versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 could, under certain conditions, allow an authenticated user with a read_api-scoped token to retrieve a project's incoming email address and create work items, bypassing token restrictions due to insufficient scope enforcement on a GraphQL field.

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file-based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause files outside the configured squirrelmail_data_dir to be read and imported.

In TOTOLINK A950RG 4.1.2cu.5268_B20221104, the UploadCustomModule function in lib/cste_modules/product.so is vulnerable to command injection via manipulation of the FileMd5 argument. The attack can be launched remotely, and the exploit has been published and may be used.

A security vulnerability was detected in massCodeIO massCode 5.10 in an unknown function of the file src/main/api/index.ts of the Local HTTP Service component. Manipulation leads to information disclosure, and the attack can be launched remotely. The exploit has been publicly disclosed and may be used; the patch is named d25d8fa3f5a1e34285c8634f18729650c0c05cda.

GitLab EE in versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 contains an issue that under certain conditions could allow an authenticated user to access paid AI features without a valid subscription due to insufficient server-side validation in billing eligibility checks.

GitLab EE contains a cleanup logic flaw that fails to distinguish pre-existing vulnerability records from newly created ones during error handling. Under certain conditions, an authenticated user with read-only permissions could permanently delete existing vulnerability records. This issue affects versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1.

GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 contains a vulnerability where an unauthenticated user could poison a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses.

GitLab CE/EE across many versions contains an integer overflow when compiling a specially crafted regular expression. Under certain conditions this could allow an unauthenticated user to execute arbitrary code on the GitLab server.

GitLab CE/EE versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 could, under certain conditions, allow an unauthenticated user to retrieve sensitive internal server credentials due to improper filtering of internal response headers.