CVE Vulnerability Catalog

In flightctl, the configureRepoHTTPSClient() function in the device-render worker builds a per-repository TLS configuration and installs it into go-git's process-global client.Protocols map. Because the worker renders devices for multiple organizations concurrently from a shared goroutine pool, the last tenant's TLS configuration wins for all in-flight git.Clone calls.

Dell ObjectScale versions prior to 4.4.0.0 contain an Incorrect Permission Assignment for Critical Resource vulnerability in the OS. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contain an Improper Privilege Management vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.

A flaw was found in the first-broker-login flow of the keycloak-services component. It allows an attacker to register a matching username on an external identity provider, causing a collision in Keycloak and locking out the legitimate user.

FileRise before version 3.28.0 contains a privilege escalation vulnerability that allows authenticated low-privilege attackers to gain unauthorized read and write access by exploiting improper session isolation between the WebDAV interface and the web application session context. Attackers can combine valid Basic-Auth credentials with an active admin PHPSESSID cookie to bypass authorization boundaries.

An authorization bypass vulnerability in reNgine through 2.2.0 in the GetFileContents API endpoint allows any authenticated user to read bundled recon tool configuration files. Low-privilege Auditor roles can access files containing third-party API keys for services like SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge and Hunter.

A server-side request forgery vulnerability in Hippo4j through 1.5.0 in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud metadata services.

A server-side request forgery vulnerability in MLRun through 1.11.0 in the WebhookNotification handler allows authenticated users to make the API server send arbitrary HTTP requests to internal addresses. Attackers can update a run with a malicious webhook notification that executes when the run reaches a terminal state, enabling requests to internal services, Kubernetes APIs, or cloud metadata endpoints from within the cluster.

An authorization bypass vulnerability in TDuck survey form through version 5.0 in the POST /user/form/data/update endpoint allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify arbitrary form responses containing personal data by sending update requests without ownership validation.

An information disclosure vulnerability in Rallly before 4.15.0 in the polls.get tRPC procedure returns scheduled-event invitee names and email addresses to unauthenticated callers. Attackers can access a poll's urlId from public invite links to retrieve sensitive invitee information regardless of privacy settings.

A CSRF vulnerability in PbootCMS up to 3.2.24 affects the UserController::del and UserController::mod functions in the User Management component. The attack can be performed remotely, and the exploit has been publicly disclosed. Upgrading to version 3.2.25 resolves the issue.

A vulnerability in the Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2s_calendar_move_post AJAX handler issues an UPDATE against the b2s_posts table using only the attacker-supplied b2s_id primary key with no blog_user_id ownership constraint, allowing any user with the edit_posts capability to reschedule, suppress, or alter the publication state of any other user's scheduled social media post.

A vulnerability in Plate rich-text editor prior to 53.3.11 (and in discontinued 54.0.0-beta builds) affects HTML deserialization APIs that parse supplied HTML strings in the active document. When an application passes untrusted or cross-user HTML, certain HTML attributes can trigger browser behavior before conversion to editor nodes, possibly allowing attacker-controlled script execution in the application's origin when another user loads the deserialized content. Fixed in version 53.3.11.

An authenticated blind SQL injection vulnerability in ScadaLTS 2.8.1-release-candidate build 0 in the /api/events/search endpoint. The sortBy array values are concatenated directly into the SQL ORDER BY clause without sanitization, allowing authenticated users with ROLE_USER to perform time-based and boolean-based blind SQL injection to extract arbitrary data, including password hashes of all users.

A vulnerability in Zope AccessControl prior to 7.4 concerns the safety of str.format and str.format_map when reached through a str subclass. In ImplPython.py and cAccessControl.c, formatting can recursively access attributes and subscriptions using unrestricted getattr and getitem behavior instead of policy-restricted operations. A controlled format string can therefore disclose objects reachable from values available to the formatting operation. Fixed in version 7.4.

In BIND 9, a validly signed NSEC3 record from an unrelated sibling zone may be accepted as an insecurity proof. This downgrades a secure delegation and allows a forged unsigned answer to pass through.

In a query response, an attacker may send named multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is identical on all copies, the record is appended to the in-memory RDATA set, increasing negative cache memory usage.

In OpenFGA prior to 1.18.1, the ListUsers API could return a user that should have been excluded when an authorization relation used an intersection containing a base but not excluded operand, the base was granted through a type-bound public wildcard, and the excluded user also had a concrete tuple through another intersection operand. Applications using ListUsers to enforce access could treat an excluded user as authorized.

A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. Default limits on max-records-per-type and max-types-per-name help mitigate the exposure.

For a secondary zone with transfers restricted by TSIG, named may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker without a valid TSIG signature to send unauthorized zone contents to a secondary server, and named does not roll back to the pre-transfer state.