CVE Vulnerability Catalog

Envoy prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 — Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic names without HTML encoding. A data-plane component such as grpc_stats with stats_for_all_methods enabled can incorporate attacker-controlled path segments into cached dynamic statistic names. When an operator views the HTML stats page, the stored name can execute script with the admin interface's origin and issue privileged same-origin requests. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Envoy prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 — Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without END_STREAM. Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open, leaving ClientStreamImpl with a dangling response_decoder_ reference. A later frame on the stream can dispatch through the freed object and crash the process. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Envoy prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 — Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect, replaces the ActiveStream and updates EnvoyQuicServerStream but does not update the handler's cached pointer. A subsequent HTTP/3 datagram can call decodeData through the freed decoder, causing invalid virtual dispatch and a process crash. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, POST /api/auth/token authenticates with username and password only, then calls getTokens(), which returns full access and refresh JWTs without checking whether the account has TOTP 2FA enabled. An attacker with stolen or phished credentials can bypass 2FA in a single request. The parallel login endpoint (POST /api/auth/login) correctly enforces 2FA by calling setCookies(user, res, true), which gates on user.twoFaEnabled. Version 2.4.0 patches the issue.

luci-app-advanced-reboot for OpenWrt prior to 1.1.2-6 granted rpcd file.exec permission for the /bin/sh shell under a read ACL. An authenticated delegated session with that ACL could supply caller-controlled parameters, allowing arbitrary commands to execute as root.

luci-app-adblock-fast for OpenWrt prior to 1.2.4-2 allowed the luci.adblock-fast.setCronEntry RPC method to accept an entry argument containing carriage-return or line-feed characters and serialize it into /etc/crontabs/root as one logical line. An authenticated delegated user with the write ACL could create an additional root cron entry, resulting in persistent command execution as UID 0.

Tautulli prior to 2.17.2 in the import_config handler and the database_file branch of import_database joins the attacker-controlled filename directly to CACHE_DIR without basename reduction or a containment check. An administrator or caller with the instance API key can submit a multipart filename containing parent-directory segments, causing the upload to be created or overwritten outside CACHE_DIR.

Dell Command | Monitor (DCM) versions prior to 10.13.2 contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authorization-relation rows without privilege checks. Attackers can manipulate user-role mappings and access controls to escalate privileges, strip access from other accounts, or modify role-function relationships for any user in the tenant.

jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delete other users' business objects by submitting direct object identifiers without authorization checks.

jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and access all business records in the tenant.

jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuration. Attackers can rewrite or delete tenant-wide settings covering company identity, stock rules, approval behavior, and printing configuration through the systemConfig endpoint.

jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to reset any other user's password. Attackers can submit a request with an arbitrary target user ID to reset that account's password to a known default value.

jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbitrary roles. Attackers can send a POST request with type=UserRole, their own user ID, and a role ID list to escalate from low-privilege tenant user to tenant administrator.

A weakness has been identified in ColorFul iGameCenter 1.0.3.4, affecting the function sub_140001AF0 in the ene.sys library of the IOCTL Handler component. This manipulation causes an untrusted pointer dereference. The attack can only be executed locally, and the exploit has been made publicly available.

Warpgate, an open source SSH, HTTPS and MySQL bastion host for Linux, prior to 0.25.6 has a vulnerability in api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs. The endpoint /@warpgate/admin/api/recordings/{uuid}/stream is protected only by session authentication, omitting require_admin_permission for AdminPermission::RecordingsView. Any authenticated regular user who identifies an active recording can subscribe to its WebSocket and receive real-time terminal input and output from proxied SSH, MySQL, or PostgreSQL sessions, including credentials and commands.

Dell Command Powershell Provider (DCPP), versions prior to 2.10.2, contain an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.

The Time-aware GPIO driver in Zephyr OS lacks validation of output pointers in the tgpio_pin_read_ts_ec() syscall, allowing an unprivileged thread to write to arbitrary kernel memory. The vulnerability only affects builds with CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y, and practical exposure is limited by build issues in some versions.

Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. This occurs in button.text.toUtf8 in export_output_html.cpp. Exploitation cannot occur unless HTML export was used by a victim, but the exploit payload can be exported if a message were forwarded into a group by a member.

KubeEdge, an open source system for extending native containerized application orchestration capabilities to hosts at Edge, from 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, has a vulnerability in the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go. The function joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory.