CVE Vulnerability Catalog

The Apache Pulsar broker admin REST API endpoints for non-persistent topics (/admin/v2/non-persistent/.../entryFilters) do not perform the entry filters topic policy authorization check, unlike persistent topic endpoints. An authenticated user with produce or consume permission on a non-persistent topic can read, replace, or remove that topic's entry filter policy. This affects versions from 3.3.0 before 4.0.14 and from 4.1.0 before 4.2.5.

The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions. When authentication and authorization are enabled, most read endpoints of this API verify only that the request is authenticated and that the broker serves the requested topic or transaction coordinator, without checking whether the caller is permitted to access the tenant, namespace or topic whose data is returned. As a result, any authenticated user, including one with no permissions, can read transaction coordinator and transaction information belonging to other tenants.

When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smuggle requests past the front end and desynchronize responses for other users.

Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, allowing an attacker to smuggle requests past ATS access controls, disrupt other users' requests, or poison the cache.

NoMachine nxhtd contains a Server-Side Request Forgery information disclosure vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of NoMachine without authentication. The flaw exists within the web service listening on UDP port 4443 by default and results from the lack of proper validation of a URI prior to accessing resources.

The authentication mechanism controlling access to the Redis database in NoMachine uses insufficient entropy when generating credentials. A local attacker able to execute low-privileged code can exploit this to escalate privileges and execute arbitrary code in the context of the service account.

NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NoMachine without authentication. The flaw exists in the parsing of mDNS resource records due to lack of proper validation of user-supplied data length before copying to a heap-based buffer.

MindsDB contains a code injection remote code execution vulnerability in the OpenBBtable class. Authentication is required; the flaw is due to lack of validation of a user-supplied string before using it to execute Python code, allowing an attacker to execute code in the context of the service account.

CrewAI contains a remote code execution vulnerability via unsafe reflection during agent loading. User interaction is required—the target must load a malicious agent configuration from the repository. The flaw exists in the load_agent_from_repository function, which does not properly restrict a user-supplied argument before using it to import a module, allowing code execution in the context of the service account.

BusyBox libarchive contains a symlink directory traversal vulnerability allowing remote attackers to create arbitrary files. User interaction is required: the target must visit a malicious page or open a malicious file. The flaw results from lack of proper validation of a user-supplied path before use in file operations.

Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability. The specific flaw exists within the _get_shared_drive_object method. The issue results from the lack of proper validation of a URI prior to accessing resources.

Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the _get_shared_drive_object method. The issue results from the lack of proper validation of a URI prior to accessing resources.

A vulnerability in Luxion KeyShot during BIP file parsing allows remote code execution in the context of the current process. The flaw results from loading a library from an unsecured location (uncontrolled search path element). User interaction is required: the target must visit a malicious page or open a malicious file.

GIMP contains a stack-based buffer overflow in APNG file parsing due to lack of proper validation of user-supplied data length before copying it to a stack buffer. A remote attacker can achieve arbitrary code execution in the context of the current process if the target opens a malicious file or visits a malicious page.

MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session tokens across new ECDH sessions. The makeSessionKey function in libucrypto.so generates tokens using fixed salts without channel- or session-specific input, and the user service validates tokens without verifying channel context, enabling stolen tokens to grant persistent administrative access until the token store is explicitly cleared.

LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those internal responses as gallery content.

gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../' sequences, causing os.RemoveAll to delete any directory writable by the server process.

pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. An attacker supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF.

In ProjectWorlds Advanced Library Management System 1.0, the mysqli_query function in returned_book_search.php (Search Form component) does not protect the datefrom/dateto arguments, allowing SQL injection. The attack can be executed remotely, and a public exploit is available that could be used for attacks.

In ProjectWorlds Advanced Library Management System 1.0, manipulating the firstname/middlename/lastname/address/branch/type arguments in edit_member.php leads to SQL injection. The vulnerability is remotely exploitable and a public exploit is available.