CVE Vulnerability Catalog

A vulnerability was identified in huanzi-qch base-admin in the Save function of CommonController.java (Add User Handler component). Manipulation of the Username argument leads to cross site scripting, and the attack can be initiated remotely. The exploit is publicly available and might be used.

GitLab CE/EE contains a race condition in the MCP search tool's shared state handling that could cause search results to be returned under an incorrect user context. Affected versions are from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1.

In sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8, the MD5.getMD5 function in MD5.java uses a one-way hash without salt for user password handling. The attack can be initiated remotely, though it requires high complexity and is assessed as difficult.

In sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8, the getProperties function in MailUtil.java results in cleartext transmission of sensitive information. The attack can be initiated remotely, though it requires high complexity and is assessed as difficult.

The WikiLambda extension for MediaWiki before version 1.47.0 has improper handling of insufficient permissions, allowing access to functionality not properly constrained by ACLs. The issue affects Linux, MacOS, and Windows.

In sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8, unknown code in CommonUserServiceImpl.java leads to cleartext storage of sensitive information. The attack can only be performed locally, and the exploit has been publicly disclosed.

GIMP's uncompressed DDS image loader has a one-byte out-of-bounds heap read flaw. After processing the final pixel, the file-dds plug-in performs an unconditional one-byte look-ahead, which may cause a crash if the byte is inaccessible.

OpenBao Agent's exec rendering mode could write secrets from env_template to standard output when exec.go re-created the template runner after repeated rendering failures, primarily after num_retries was reached. A process supervisor, log collector, or local user able to read that output could obtain the rendered secret values. This issue is fixed in version 2.6.0.

RunAdHocCommand.build_args() appends limit as a bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags (--version, --help) since the injected element displaces the required pattern positional. Would escalate if ansible-core ever defaults pattern.

LaunchConfigurationBaseSerializer.scm_branch has no validate_scm_branch() leading-dash check, unlike Project/JobTemplate/JobLaunch serializers. Schedule and WFJT Node accept --upload-pack=/bin/id as scm_branch. Currently blocked at runtime by jobs.py:1502 ValueError check (defense-in-depth), but the API validation gap means sole reliance on a task-layer guard. Refactoring that guard away would promote this to RCE.

Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts (job['job'+'_env']) and {% if job.id > 100 %} conditional gating bypass both the AST check and the test-render (stub has small job.id). At runtime, the gated branch executes and exceptions write full tracebacks into the notification body, which is POSTed to an attacker-controlled webhook URL. Leaks install paths, Python version, source line numbers.

alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failure, causing the application to abort.

IBM Guardium Data Protection 12.2 could allow an administrative user to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted XML document.

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy. Affects versions: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.47 through 9.0.121. Known affected EOL versions: 8.5.67 through 8.5.100. Recommended upgrade to 11.0.26, 10.1.60 or 9.0.122.

The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post. This allows unauthenticated visitors to retrieve the title, content or excerpt of arbitrary posts, including private, draft, pending, trashed and password-protected ones.

Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path. Malformed input can cause a read beyond buffer boundaries.

The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details. This allows unauthenticated attackers to view another customer's order using the order's key.

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action. This allows Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.