CVE Vulnerability Catalog

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.

Ditty before version 3.1.70 has a stored XSS vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The rendering function inserts these values without allowlist validation, bypassing wp_kses_post() sanitization.

In Apache Airflow 3.3.0 and 3.3.1, there is an authentication precedence issue: when a request carries both a session cookie and an explicit Bearer token, Airflow resolves the caller from the cookie and ignores the token. This causes the request to execute as the cookie's principal rather than the token identity, leading to misattributed audit records.

The /assets/events API in Apache Airflow returns asset events for all DAGs without filtering according to the caller's permissions. Any authenticated user with asset-read access can enumerate events, including source DAG IDs, task IDs, run IDs, and timestamps, for DAGs they are not authorized to see. Even the total_entries and pagination disclose the existence of hidden DAGs.

nginx ignition (the UI for the nginx web server) in versions 2.33.0 through 2.35.0 has a vulnerability that allows a user with OTP 2FA enabled to reuse their TOTP during the standard 30-second validity window. Version 2.35.1 patches this issue.

GoCD from version 16.1.0 to 26.1.0 has a vulnerability in the internal material connection test APIs. A pipeline group administrator can invoke Test Connection for source control materials outside their authorized group and potentially use credentials from those materials. It may also resolve external secrets managed by secret-management plugins.

mport (the MidnightBSD Package Manager) before version 2.7.8 used TMPDIR while extracting package metafiles, even when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to an attacker-controlled location.

The /jobStatus.json API in GoCD before version 26.1.0 does not validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request. An authenticated user can guess job IDs and retrieve status for jobs in pipelines they cannot view, including job names, state, timestamps, agent IP addresses, and associated stages.

In GoCD from 12.3.1 until 26.1.0, legacy routes under /go/admin/restful/* expose historical full server configuration to pipeline group administrators instead of restricting responses to the groups they administer. The disclosed configuration can include agent auto-registration keys, webhook invocation keys, encrypted material credentials, and GoCD administrator lists.

In GoCD from 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline template by name without the required view permission and read its configuration.

In MISP, when a regular user adds a reference between objects or attributes, the system checks whether the user can access the overall event but does not always check whether the individual pieces of data are also allowed for that user. A user who can view an event could potentially access attributes or objects inside that event that were meant to be restricted to a specific sharing group or distribution level.

In MISP, when a user creates or edits a report inside an event, the system can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event. A user with editing rights on one event could move a report from another event into their own event if they know or can guess the report's UUID, then view and change information they were not originally allowed to access.

Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where old_value and new_value entries are rendered without proper escaping. Any user permitted to edit tracked text fields can inject malicious markup that executes when other users, including administrators, view the record's Chatter panel.

Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to register alert rules and receive notifications disclosing target system names and metrics.

UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE_AGENT can enumerate saved reply identifiers and read content reserved for groups and teams they do not belong to.

UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLE_AGENT can inject malicious script into the identifier field, which is persisted and executed when other members access the configuration update page.

The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously.

MISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contextual menu JavaScript component. The ContextualMenu class populates HTML <option> elements by assigning user-controllable values to the innerHTML property. Because innerHTML parses and renders HTML markup, any untrusted string supplied as the option text (value.text or value) is interpreted as live DOM content rather than plain text.

MISP contains a stored cross-site scripting (XSS) vulnerability in the default theme's Galaxies index page. Sample tag names from unknown galaxy clusters are inserted into HTML without entity encoding, allowing a user with tag-editor privileges to inject malicious script. A site administrator viewing the Galaxies page executes that script in their browser session.

A vulnerability was found in ST Engineering iDirect iDX and Evo iDX, affecting the /authorize file of the HTTP Request Handler component. Manipulation of the Success argument leads to HTTP response splitting, exploitable remotely, and the exploit has been publicly disclosed. This vulnerability only affects products no longer supported by the maintainer; current supported releases (X10, X11, Velocity 5.x+) have no validated evidence of impact.