CVE Vulnerability Catalog

Horilla in version 1.5.0-85 and earlier does not consistently authorize access in payroll/views/component_views.py in allowances_deductions_tab, view_single_allowance, and view_single_deduction before loading records selected by emp_id, allowance_id, or deduction_id. An authenticated employee can substitute those identifiers to read another employee's salary structure, allowance and deduction amounts, personal loan disbursements, and repayment schedules without owning the record or holding payroll-view permissions.

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes, retaining full control of the dashboard since tokens are verified only against a static JWT secret that is never rotated.

Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit unlimited password guesses without rate limiting, attempt counters, lockouts, or delays to gain full administrator access and modify application configuration.

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single unauthenticated request to consume provider quota or access sensitive configuration data.

The WikiLambda extension in MediaWiki contains an XSS (Cross-Site Scripting) vulnerability due to improper input neutralization during web page generation. The issue affects version 1.47.0-alpha and has been remediated on the master branch.

The UploadWizard extension in MediaWiki contains an XSS (Cross-Site Scripting) vulnerability due to improper input neutralization during web page generation. The issue affects versions from * before 1.46.1, 1.45.5, 1.43.10.

The FlaggedRevs extension for MediaWiki through version 1.46.0 fails to properly remove sensitive information before storage or transfer. This can lead to exposure of data that should have been redacted or removed.

PHP's OpenSSL stream peer verification checks subjectAltName entries first and falls back to Common Name when no entry matches. RFC 6125 requires CN to be ignored once the certificate presents any service identity, so a certificate with a non-matching DNS SAN was still accepted when its CN matched the requested peer_name.

php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation.

When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin.

phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine.

RustDesk versions before 1.5.0 fail to properly validate file transfer permissions on incoming file clipboard messages in the Cliprdr message handler on Linux and macOS. Authenticated remote peers with disabled file transfer permissions can place files onto the host clipboard and retrieve copied files and contents from the process-wide clipboard cache.

The Wikibase extension for MediaWiki contains a Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions before 1.46.1, 1.45.5, and 1.43.10.

The Wikipedia Android App exposes sensitive information to unauthorized actors, allowing access, interception, or modification of HTTP cookies. This issue affects the main branch of the application.

The Translate extension for MediaWiki has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. This issue affects versions before 1.46.1, 1.45.5, and 1.43.10.

Vulnerability of sensitive information exposure to unauthorized actor in Mediawiki WikiLambda Extension. Affects version 1.47.0-alpha and has been remediated on the master branch.

Cross-Site Scripting (XSS) vulnerability in Mediawiki TemplateSandbox Extension due to improper input neutralization during web page generation. Affects versions before 1.46.1, 1.45.5, and 1.43.10.

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behavior and may not trigger. When the check is optimized away, a malicious SOAP server can cause allocation of a buffer too small, leading to heap buffer overflow.

Reflected XSS vulnerability in Mediawiki Cargo extension due to improper input neutralization during web page generation. Affects versions through 3.9.4.

Reflected XSS vulnerability in Mediawiki Cargo extension due to improper input neutralization during web page generation. Affects versions through 3.9.4.