CVE Vulnerability Catalog

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTTP or HTTPS URL reached by Streamlink can return a redirect to a local file URL, causing HTTPSession to read the local file and return its contents to the response consumer. This bypasses the direct file URL checks added for HLS and DASH content because the manifest contains an ordinary network URL and the scheme transition occurs later during fetch handling. The flaw applies to every request made through HTTPSession, and a segment fetch can place the local file contents into stream output. This issue is fixed in version 8.6.0.

The WPGraphQL plugin for WordPress prior to 2.22.2 does not enforce object-level capabilities in the updatePost mutation. An authenticated Contributor can publish their own drafts without editorial approval or modify their own previously published posts despite lacking edit_published_posts.

The Solspace Freeform plugin for Craft CMS 5.x from 5.0.0 through 5.10.13 allows submitted values from public forms to be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in field values and receive evaluated PHP, OS, or Craft filesystem-path constants in the response.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 and prior to 5.36 contain a Weak Encoding for Password vulnerability. A low-privileged attacker with local access could exploit it, leading to information disclosure, information tampering, protection mechanism bypass, and unauthorized access.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could exploit it, leading to information disclosure, information tampering, and protection mechanism bypass.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Insufficient Session Expiration vulnerability. A low-privileged attacker with adjacent network access could exploit it, leading to elevation of privileges, protection mechanism bypass, and unauthorized access.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Improper Restriction of Rendered UI Layers or Frames vulnerability (clickjacking). A low-privileged attacker with remote access could exploit it, leading to elevation of privileges and session theft.

REDAXO prior to 5.21.2 in sync.php inserts filenames from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker able to place an unregistered file with HTML metacharacters in the media directory can execute script in the browser of a backend user with media[sync] permission.

REDAXO prior to 5.21.2 in the mediaIsInUse() handler in media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping. An administrator with Media Manager access can store HTML in a type name, and the payload executes in another administrator's browser when deleting media referenced by the type's effects.

REDAXO prior to 5.21.2 in rex_api_install_package_update in api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site.

REDAXO prior to 5.21.2 in rex_list::getSortColumn() in list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. An authenticated backend user can make prepareQuery() add an escaped but unauthorized ORDER BY identifier, allowing error-based enumeration of columns in joined tables and ordering by unselected sensitive fields such as rex_user.password.

The scim-patch library before version 0.9.2 has a vulnerability where navigate() and assign() improperly handle inherited properties when processing SCIM PATCH paths. An attacker can exploit properties like toString to mutate global process objects, affecting application logic.

Dell Secure Connect Gateway (SCG) Policy Manager before version 5.34.00.16 contains an improper privilege management vulnerability. A low-privileged attacker with remote access could gain unauthorized access.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper authorization.

The SUMIT Payment Gateway for WooCommerce before version 4.0.0 does not verify that payment notifications from the payment provider are genuine before marking orders as paid. This allows unauthenticated users to mark pending orders as paid without completing payment.

Server-Side Request Forgery (SSRF) vulnerability in Weoll before version 3.2.45.44 allows an attacker to send requests from the server to internal resources.

Vulnerability in Keycloak's Pushed Authorization Request (PAR) implementation. When silent authentication (prompt=none) is used, the authorization process skips certain steps, failing to enforce that a pushed request URI is used only once. An attacker can reuse the URI to obtain multiple authorization codes for a logged-in user, violating security standards like FAPI-2.

Vulnerability in Keycloak's Conditional OTP authenticator. The system evaluates specific HTTP headers to decide whether to skip OTP but does not verify if those headers are from a trusted source. An attacker with the user's password can bypass second-factor authentication by providing a crafted header.

Open redirect vulnerability in AVESİS by Abis Technology allows input data manipulation, potentially redirecting users to untrusted sites.

Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0-M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100.