CVE Vulnerability Catalog

GitLab CE/EE contains a missing authorization check on linked work items within visible epics. An authenticated user could read private child issue contents, including titles and descriptions, from projects they had no access to.

An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the RTU500 to reboot through the reset endpoint. Successful exploitation could cause temporary device unavailability and disruption of its intended operation.

A vulnerability in the Teradata provider for Apache Airflow affects the example Dag, which defines parameters as free text and templates them into operators, allowing a user with lower privileges to inject SQL fragments. This can lead to code execution under the task's connection and redirect the task to other connections.

Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. An `account` value containing `/`, `?` or `#` demoted the intended domain to a path, query or fragment, leaving the attacker in control of the request host. The same unvalidated value was also used to build the OAuth token-request URL and the Cortex Agent base URL.

A vulnerability in the Google provider for Apache Airflow involves improper interpolation of file and folder names into Google Drive queries without escaping quote characters. An attacker controlling names (e.g., by creating objects in buckets) can inject additional clauses into the query, potentially redirecting transfers to unauthorized locations or swapping downloaded files.

A vulnerability in the Teradata provider for Apache Airflow causes cloud storage credentials to be embedded directly into SQL statements by the S3ToTeradataOperator and AzureBlobStorageToTeradataOperator. The credentials end up in Airflow task logs and Teradata query logs (DBQL), where they are not masked. The issue affects the default authentication path when no AUTHORIZATION object is configured.

A vulnerability in HPE OneView can be remotely exploited to cause a URL redirect. No further technical details are provided in the description.

Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet, and ResourceBundleReloadServlet, which could result in denial-of-service conditions affecting application availability.

GitLab EE contains improper authorization enforcement. An authenticated user with guest-level permissions could read private security policy content they were not authorized to access.

In the dash shell, the printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b can write one or two bytes past that reservation.

In the dash shell, when built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames or otherwise feed that matcher can make a short multi-star pattern such as *.*.*.*.*.tar.gz consume excessive CPU.

Apache Karaf's config:install command is not covered by any ACL rule and is therefore allowed for any authenticated user, including one with only the viewer role. The command fetches a file from an arbitrary URL and writes it into karaf.etc, which contains security-relevant files such as users.properties, keys.properties, host.key, and all ACL configuration files. With the --override flag, existing files can be overwritten, and Felix FileInstall automatically reloads changed .cfg files without requiring a restart.

Progress Telerik Fiddler Everywhere before version 8.2.0 exposes privileged IPC functionality. A local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application can replace the application UI or settings with attacker-controlled content.

A vulnerability has been found in coolbeans1212 MateisHomePage-Website up to ea2a4226deeca27ab1fb9df0552ec76444547811. Affected is some unknown functionality of the file users.php, where manipulation of the Search argument causes cross site scripting, and the attack can be initiated remotely.

A vulnerability has been found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. The affected element is an unknown function of the file manage-food.php. Such manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.

A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of the component Media Crop Handler. This manipulation of the argument saved_avatar causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 2.9.3 is recommended to address this issue. Patch name: c143e145caa600947e70a240e87f2fed889149d3. It is suggested to upgrade the affected component.

Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes outside the sandbox that share the same process group. A malicious or compromised Flatpak app can use this to cause denial of service by terminating processes outside its sandbox, such as the desktop shell.

A vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.20260602 in the file application/database.php of the Database Management component. Manipulation leads to execution with unnecessary privileges. The attack can be launched remotely, and the exploit is public.

A security flaw was discovered in MODSetter SurfSense up to 0.0.36 in the file surfsense_backend/app/routes/editor_routes.py of the Document Export Feature. Manipulation results in server-side request forgery. The attack can be initiated remotely, and the exploit is public. Upgrading to version 0.0.36.3 is recommended.

A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5 in the escapeshellcmd function of the file ajax/openvpn/del_ovpncfg.php of the OpenVPN Configuration Handler. Manipulation of the cfg_id argument leads to OS command injection. The attack can be launched remotely, and the exploit is public.