CVE Vulnerability Catalog

Novu before version 3.18.0 accepts notification redirect URLs without validating the URL scheme, allowing javascript: in the redirect attribute. When a recipient clicks the notification, JavaScript can execute in the app context, potentially exposing session data.

In MISP's UsersController login(), the pre-auth query for TOTP verification did not include the User.disabled column, so the disabled flag was not checked in that branch. Although later identify() validation still rejects disabled accounts, a TOTP-enabled user can proceed to the verification step.

In MISP, the __uploadLogo method in OrganisationsController processes a caller-supplied tmp_name with filesystem probes before verifying it is a real upload. An authenticated site-admin can supply an arbitrary server file path, allowing to check for file existence and determine image types.

In MISP, the __statisticsOrgs method uses the organization name directly as a file path component when checking for logo existence. Although the target directory does not exist, the pattern is a path traversal weakness that could allow probing arbitrary files if the directory existed.

The findOrgImage method in MISP constructs a file path from an organization identifier without validation, allowing path traversal. An authenticated user with ability to create or import events can set an organization name with traversal sequences, enabling arbitrary file existence probing and limited file read for .png or .svg extensions.

MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group (SG) editor role can trigger this code path, allowing them to modify organization metadata that should be restricted to site administrators or users with sync permissions.

In MISP, the EventReport::uploadPicture method processes a caller-supplied tmp_name field by invoking file_exists(), mime_content_type(), and exif_imagetype() on the supplied path before verifying that the value was a genuine PHP upload via is_uploaded_file(). An authenticated user holding the perm_add permission could supply an arbitrary filesystem path as the tmp_name value. The application would then probe that path and return distinct validation error messages depending on whether the file existed, its MIME type, or its image format, allowing enumeration of file existence and type.

MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of suggestion content within an event report, was incorrectly mapped to the wildcard permission ('*') in the ACLComponent, making it accessible to any authenticated user regardless of their assigned permissions. All analogous report-modification actions correctly required the perm_add permission, while read-only actions such as downloadAsPDF appropriately used the wildcard.

In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event's distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed.

A vulnerability was found in mtrano APENCMS up to 6546096d354153309693efabb9a0d824628ed4f5. The affected element is the function eval of the file cms/weasel.php of the component Template Engine. The manipulation of the argument $_CMS['site'] results in code injection. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.

SGLang contains a DoS vulnerability caused by missing input validation for AUX_DATA ZeroMQ control messages in the Decode worker, which enables an unauthenticated remote attacker with network reachability to the Decode control PULL socket to terminate the Decode control thread and cause a denial of service against the target server.

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_get_page_content AJAX action that allows authenticated attackers with subscriber-level access or higher to access arbitrary vendor administrator panel pages by supplying an arbitrary vendor user ID. Attackers can bypass authorization controls by submitting a target vendor ID in the request to access payout pages, financial reports, and vendor dashboard content belonging to any vendor in the marketplace.

A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffective in this context: the browser decodes the entities before the client-side framework evaluates the content as a JavaScript expression. A logged-in panel user who visits a crafted URL allows arbitrary script execution in the same-origin context of the management page, enabling data theft and unauthorized actions through the victim's session.

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause exposure of sensitive system information due to uncleared debug information. A successful exploit of this vulnerability might lead to information disclosure.

A vulnerability in NVIDIA Infrastructure Controller for Linux allows an attacker to cause improper enforcement of a behavioral workflow. Successful exploitation might lead to data tampering, denial of service, and information disclosure.

A vulnerability in NVIDIA Infrastructure Controller for Linux allows an attacker to cause external control of a file name or path. Successful exploitation might lead to code execution, privilege escalation, data tampering, and denial of service.

A vulnerability in NVIDIA Infrastructure Controller allows an attacker to cause an XML injection. Successful exploitation might lead to data tampering and denial of service.

A vulnerability in NVIDIA Infrastructure Controller for Linux involves the use of a hard-coded password. Successful exploitation might lead to data tampering, denial of service, and information disclosure.

A vulnerability in NVIDIA Infrastructure Controller allows an attacker to cause uncontrolled resource consumption. Successful exploitation may lead to denial of service.