CVE Vulnerability Catalog

In MCP Atlassian prior to 0.22.0, the streamable HTTP transport accepts requests without a user identity and falls back to operator credentials, while upload_attachment accepts an unrestricted file_path. An unauthenticated network caller can read files available to the MCP process, upload them to an attacker-selected Jira issue or Confluence page, and retrieve the contents.

In MCP Atlassian prior to 0.22.0, an HTTP transport deployment with READ_ONLY_MODE=false accepts a request without an Authorization identity and permits attacker-controlled Atlassian service headers, including X-Atlassian-Confluence-Url, to select a public attacker hostname or one allowed by MCP_ALLOWED_URL_DOMAINS. A caller can then invoke confluence_upload_attachment or the Jira attachment variant with a server-local file_path and cause the MCP process to send the file to the selected attachment endpoint.

Adobe Experience Manager Forms JEE is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session.

Adobe Experience Manager Forms JEE is affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access, causing a limited disruption to availability. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.

Bridge is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, as the victim must open a malicious file.

Bridge is affected by an Uncontrolled Recursion vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this to execute arbitrary code, and exploitation requires the victim to open a malicious file.

Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, as the victim must open a malicious file.

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exhaust system resources, causing an application denial-of-service condition, and exploitation does not require user interaction.

Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could access sensitive files and directories outside the intended access scope, and exploitation does not require user interaction. Scope is changed.

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could bypass security measures and gain unauthorized write access, and exploitation does not require user interaction.

A vulnerability was found in dgtlmoon changedetection.io up to 50389b07, affecting the function add_watch_ui_snapshot in changedetectionio/blueprint/add_watch_ui/__init__.py of the Preview Endpoint component. Manipulation of the url argument results in server-side request forgery (SSRF), and the attack can be initiated remotely. The exploit has been made public and could be used; upgrading to version 0.60.1 resolves the issue (patch 71d332d5a0d3da2a0fe89a392413bf4b7d27c84e).

Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda function that dispatches caller-supplied parameters to privileged service APIs without authorization validation. Upgrading to version 5.26 or later is recommended; after setup, delete or disable the sfExecuteAWSService function, and if retained, restrict invocation to the intended IAM user only.

MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labelled-VPN NLRI iterators of the routing service. An unauthenticated on-path attacker can send a malformed MP_REACH_NLRI UPDATE message with a prefix-length value below the minimum valid for a labelled-VPN NLRI, which passes validation while describing a route with a negative-length address portion. The fix is carried only in 7.25beta4 (a development build); the current stable release 7.24.2 and the long-term release 7.23.5 both remain affected.

Use After Free vulnerability in RTI Connext Professional (Security Plugins) allows File Manipulation. This issue affects Connext Professional: from 7.6.0 before 7.7.0.1.

Notepad++ prior to 8.9.8 contains a stack buffer overflow in NppParameters::writeSession because a session path derived from the -settingsDir= option is copied into backupPathName[MAX_PATH] without bounds checking. A sufficiently long settings directory causes the buffer to overflow when Notepad++ saves the session, terminating the process via its stack canary and causing denial of service.

Notepad++ from 8.9.7 until 8.9.8 allows the updater and signature verification path to accept a modified GUP.exe file whose embedded certificate metadata remains present even though its Authenticode digest is invalid. An attacker who can replace or plant the updater-related file can cause Notepad++ to launch attacker-modified code when a user triggers the updater path, though the issue does not provide remote code execution by itself.

Notepad++ prior to 8.9.8 contains a stack buffer overflow in PluginsManager::loadPluginFromPath because the plugin-supplied GetLexerCount() result controls a loop that writes to containers[30] without enforcing NB_MAX_EXTERNAL_LANG. A malicious or compromised plugin that reports more than 30 lexers can write beyond the stack array and corrupt control data, which can permit arbitrary code execution in the Notepad++ process context.