CVE Vulnerability Catalog

Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed messages into conversations they do not belong to.

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and ticket create requests to forge administrator-authored comments, internal notes, and tickets on any ticket.

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or assignee, or mass-close tickets, since only the default tickets:update role grant is checked.

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's subject, issue, comments, owner and assignee, because the apiTickets.single handler skips group membership checks.

ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables.

Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers under public/main/inc/ajax/. Unauthenticated or low-privileged users can call actions like get_users_by_group_course, user_by_all_roles, and export_all_certificates to harvest user names and other learners' certificate PDFs.

Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. Attackers can enumerate exeId and questionId values sent to the open_answer_grade endpoint to expose other students' answers through feedback and consume AI quota.

Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to modify gradebook certificates. Attackers can request the set_default_certificate endpoint with any course id and document id to tamper with certificate configuration for any course.

Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users with only `access_dashboard` to create administrators and grant permissions. Attackers can call `CreateTeamMember::store()` or `Permissions::togglePermission()` directly over `/livewire/update` to create admin accounts and escalate to full administrator.

Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from run_code in the CodeMode toolset. Users or prompt-injected content can invoke tools via run_nested_call() without check_before_tool_call, exceeding operator limits on costly or side-effecting tools.

A SQL injection vulnerability was found in the Insurance-Management-System within the mysqli_query function of /Agent/ManagePolicy/EditPolicyHolder.php. Manipulating the Policy_no/Name argument allows SQL injection. The flaw can be exploited remotely and a public exploit is available.

SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpsp_el_editor_form AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or reschedule administrator posts, or publish other users' pending or draft posts.

A vulnerability in the streaming RPC component of Apache bRPC (versions < 1.18.0) allows a remote attacker to exhaust server memory and cause denial of service by sending a single RPC request that declares an excessive number of streams. The server creates one response stream per stream identifier in the extra_stream_ids field without limiting the number of streams accepted in a single RPC, and each stream allocates its own bthread execution queue and resources.

A vulnerability in Apache bRPC (versions < 1.18.0) allows unbounded memory accumulation in the stream message reassembly path. A remote attacker can send an endless sequence of continuation data frames to exhaust server memory, causing a denial of service.

An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through 1.17.0). A client creating multiple streams in a single RPC indexes returned extra_stream_id values without first validating the returned list size, so a malicious or compromised server can return a malformed StreamSettings response with fewer identifiers and trigger an out-of-bounds read.

Missing authentication in the streaming RPC path of Apache bRPC (version < 1.18.0) allows a remote attacker to bypass server authentication and inject or deliver streaming frames when a server is configured with an Authenticator. Streaming frames never pass through the authentication hook, and streams can be impersonated by another socket carrying the same id.

Resource exhaustion vulnerability in Apache bRPC versions before 1.18.0 affects multiple parsers that accept wire-controlled input. The gzip/zlib/snappy decompressors enforce no output limit, and the AMF, RTMP, sofa-pbrpc, and mcpack2pb parsers trust wire-declared sizes, allowing attackers to cause disproportionate memory use and crash the process.

Apache bRPC versions < 1.18.0 contain an uncontrolled resource consumption vulnerability in the HTTP/2 (h2) receive path. A remote unauthenticated attacker can send crafted HTTP/2 frames to crash the server or cause unbounded memory growth. The root cause is that receive-side limits (e.g., MAX_CONCURRENT_STREAMS, MAX_HEADER_LIST_SIZE) are advertised but never enforced, and control-frame acks bypass the write buffer cap.

A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC (version < 1.18.0) allows a remote attacker to crash the server process by sending a crafted sequence of HPACK headers, resulting in a denial of service. The root cause is an incorrect dynamic-table ring buffer sizing (34 instead of 33 bytes per entry), which leads to overflow and a CHECK abort.

A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. When the Abort message names the chunk stream currently being parsed, the object is deleted while Feed() is still running, leading to use-after-free.