CVE Vulnerability Catalog

In SOCFortress CoPilot prior to 0.1.77, the POST /api/scoutsuite/generate-gcp-report endpoint passes the raw multipart filename to the file writer without sanitization or a resolved-path containment check. A traversal filename therefore writes the supplied JSON outside the intended report directory, including into the application source directory.

In the ng-antd-admin template prior to 22.0, a hardcoded default JWT secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization and impersonate any user, including administrators.

In SOCFortress CoPilot, the unauthenticated /scoutsuite-report StaticFiles mount exposes the scoutsuite-report directory, disclosing HTML reports and result files containing AWS, Azure and GCP IAM principals, resource inventories and misconfigurations. During a GCP scan, the service-account key is saved into that same web-served directory and removed only after the scan finishes, so an anonymous client can retrieve it.

In SOCFortress CoPilot prior to 0.1.76, verify_graylog_header and verify_velociraptor_header authenticate webhooks against the same publicly hardcoded fallback header, also shipped in .env.example. Deployments with unchanged secrets let an anonymous caller bypass JWT authentication, invoke active-response actions and create forged alerts.

In SOCFortress CoPilot, portal users including customer_user accounts can submit stored markup via the alert comment endpoint, which is rendered without sanitization using v-html. This enables stored XSS, and because access and refresh tokens are persisted in JavaScript-readable storage, injected script can steal them and impersonate the viewer. The same unsanitized rendering affects other SOC fields (cases, assets, health-checks), with fixes first contained in versions 0.1.70 (health-check) and 0.1.76 (comments and other SOC sinks).

MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a session cookie carrying a user_id to gain full administrative access.

In Vvveb prior to version 1.0.8.7, an authenticated IDOR on the admin/auth-token endpoint allows any administrator to read and overwrite another administrator's API tokens. The issue has been patched in version 1.0.8.7.

In Vvveb prior to version 1.0.8.7, the password reset functionality is vulnerable to an authentication bypass due to insufficient validation of the user and token GET parameters. The issue has been patched in version 1.0.8.7.

OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key in appsettings.json. An unauthenticated attacker can forge administrator tokens with an Admin role claim and access /api/admin endpoints.

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.

A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafted request to the affected system, allowing the attacker to execute arbitrary commands, resulting in remote code execution.

Apache Fineract (through version 1.15.0) is vulnerable to SQL Injection in the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance endpoint. Insufficient input neutralization allows SQL code injection.

In Teltonika Networks RUTOS devices (versions 7.22 through 7.24.2) and TSWOS devices (versions 1.9 through 1.10), an unauthenticated user can directly call LUA functions, bypassing validations that would normally apply to API requests. Because these requests do not follow proper flows, this can lead to OS command execution.

The Gravity Forms plugin for WordPress in versions up to and including 3.1.2 is vulnerable to PHP Object Injection via a Post Custom Field of List input type. The submitted value is passed to WordPress' unrestricted global maybe_unserialize() instead of the hardened GFCommon::maybe_unserialize(), allowing unauthenticated attackers to inject a PHP object into post meta. If a gadget chain exists via another plugin or theme, this could lead to remote code execution.

The Block AJAX module for Drupal improperly controls modification of dynamically-determined object attributes, enabling object injection. This affects versions from 0.0.0 to 3.0.2.

Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.

In SOCFortress CoPilot prior to 0.1.76, case-report templates uploaded by the lowest-privilege customer_user role are later executed by non-sandboxed Jinja2 engines when an admin or analyst generates a report. Lack of template content validation and cross-tenant scoping allows an attacker to inject malicious Jinja expressions that are evaluated as Python on the backend.

Docat has an arbitrary file upload vulnerability in its Upload API because the API does not validate the uploaded file path or type. An attacker can overwrite sensitive configuration files or place malicious files on the Docat web server.