CVE Vulnerability Catalog

In ApostropheCMS prior to 4.33.0 and passport-bridge prior to 1.6.1, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A client that obtains and redeems a still-valid, unconsumed token before its first use can adopt the associated session, including through the passport-bridge cross-locale flow. This is fixed in ApostropheCMS 4.33.0 and passport-bridge 1.6.1.

ApostropheCMS prior to 4.33.0 has a REST route GET /api/v1/<piece-type>/:_id/locales (and the equivalent page route) that does not apply the publicApiCheckAsync gate enforced by other read routes. An unauthenticated caller can query this route for any document _id and learn whether the document exists and which locales it is published in — a document-existence and locale-metadata disclosure that the read API is otherwise supposed to gate. This is fixed in version 4.33.0.

In the CAPTCHA integrations (Form, login-recaptcha, login-hcaptcha) for ApostropheCMS, the user-supplied response token is interpolated unencoded into the provider verification request. Crafted tokens can smuggle request parameters and disrupt CAPTCHA verification and CAPTCHA-gated forms or login flows. Automated bypass probing is possible, but a successful CAPTCHA bypass or secret disclosure has not been established.

Prior to db-connect 1.1.0 and ApostropheCMS 4.33.0, an account with view-draft access can submit a projection exclusion path that traverses a constructor prototype chain to a shared prototype member when a SQLite, PostgreSQL or multipostgres adapter is used. The unsetNestedField helper then deletes the shared runtime member, causing persistent process-wide integrity and availability effects; the default MongoDB adapter is not affected.

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification.

In the import-export module of ApostropheCMS before 3.7.0, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a write stream emits an unhandled filesystem error that can terminate the Node.js process. The source establishes this static primitive but not an end-to-end exploit or controlled arbitrary file read or write.

In the import-export module of ApostropheCMS before 3.7.0, an authenticated user with import access to a target type can supply an object or operator as an update-key value, causing the import query to match an unidentified existing document that the user has generic edit permission to modify. The normal findForEditing permission filter still limits candidate documents, so the issue does not permit permission-free overwrite of arbitrary protected content.

In sanitize-html before 2.18.0, a non-default configuration that allows meta refresh elements and their http-equiv and content attributes can retain unsafe script or redirect destinations embedded in the refresh content value. This affects ApostropheCMS using sanitize-html. The issue is fixed in sanitize-html 2.18.0.

In ApostropheCMS before 4.33.0, the exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorization criteria. The issue is fixed in version 4.33.0.

In ApostropheCMS before 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQuery when an authenticated victim loads a page with the admin bundle. The parser accepts the special __proto__, constructor, and prototype path keys, allowing browser prototype mutation that can reach an unsafe DOM sink and execute script in the victim's session. Anonymous visitors do not load the affected admin context. The issue is fixed in version 4.33.0.

In aaPanel up to 8.25.0, the GetClientIp function in class/public/common.py manipulates the X-Real-Ip argument, leading to improper access controls. The attack may be performed remotely. The exploit has been made public and could be used. The vendor confirms that the reported X-Real-Ip IP-bypass vulnerability has already been fixed.

A vulnerability was found in aaPanel up to 8.25.0 in the ExecShell function of class/public/common.py in the File Manager component. Manipulation of the sfile/dfile/access/user arguments leads to OS command injection, exploitable remotely. The exploit has been publicly disclosed, and the vendor confirms the reported RCE and LFI issues require authentication.

The Participants Database plugin (participants-database) for WordPress by xnau webdesign up to version 2.7.8.5 contains an authorization bypass through user-controlled key vulnerability. This allows exploitation of incorrectly configured access control security levels. The issue affects versions from n/a through 2.7.8.5.

A vulnerability in follow-redirects (versions 1.16.0 to before 1.16.1) causes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, sensitiveHeaders) not to be stripped when following a cross-host or protocol-downgrade redirect if the application supplied headers as an alternating array of names and values. The removal routine uses for...in, which yields numeric indices for arrays, so no header name matches the filter and nothing is removed. As a result, the application forwards credentials to an attacker-controlled destination without any error or warning.

Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching the artifact directory layout or write files outside the intended artifact storage root when the ADK API server is exposed with the non-default FileArtifactService enabled. Applications using the default InMemoryArtifactService are unaffected.

A service account with user-management permissions in one organization can read, modify, disable, or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.

SolarWinds Patch Manager exposes sensitive information accessible to local users, which could be used to gain elevated privileges. The vulnerability allows a local attacker to obtain sensitive data.

SolarWinds Observability Self-Hosted is affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages. This may lead to session hijacking.

SolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated attackers to cause the application server to send requests to attacker-controlled or internal destinations.

SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions.