CVE Vulnerability Catalog

Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use setChannelVar to execute write dialplan functions, including FILE() writes, even when live_dangerously in asterisk.conf is set to no. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid read-only ARI credentials; HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled.

Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a stack buffer overflow in res_xmpp XMPP namespace prefix handling using carefully crafted packets. The res_xmpp module must be loaded, an XMPP connection must be configured in xmpp.conf, and the attacker must have an XMPP account on the same or a federated server.

A weakness was identified in oretnom23 php-travel-agency-system in an unknown function of contact_insert.php in the Contact Form Handler component. Manipulation of the name/company/email/topic/phone/comments arguments causes SQL injection, the attack can be initiated remotely, the exploit has been made public, and the project has not responded to the issue report.

A security flaw was discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635 in an unknown function of traceapplication.php. Manipulation of the Search argument results in SQL injection, the attack can be launched remotely, the exploit has been released to the public, and the project has not responded to the issue report.

Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go in FileBrowser Quantum resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user's authorized scope. Download, preview, media, OnlyOffice, and public-share read flows that enable FollowSymlinks can therefore serve an out-of-scope target through a reachable in-scope symlink; an authenticated user with download access can read server-accessible files outside the assigned scope, and a holder of a public share link can do the same without an account when the shared directory exposes such a symlink.

Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Join and executed through sh -c. An authenticated contributor can include shell metacharacters in the workspace name, causing arbitrary commands to execute as the Atlantis service account. The issue is fixed in version 0.47.1.

Tanium addressed a compression bomb vulnerability in Enforce. The flaw may lead to excessive resource consumption when processing crafted compressed data.

Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. The flaw may allow resource exhaustion through crafted requests or data.

Tanium addressed an improper output sanitization vulnerability in Enforce. Inadequate output sanitization may allow content injection or unsafe rendering of data.

Tanium addressed an improper output sanitization vulnerability in Comply. Inadequate output sanitization may allow content injection or unsafe rendering of data.

Tanium addressed an unauthorized code execution vulnerability in Threat Response. The flaw may allow code to be executed without appropriate permissions.

Tanium addressed a heap-based buffer overflow vulnerability in Index. The buffer overflow may lead to memory corruption and potential code execution.

Tanium addressed a local privilege escalation vulnerability in End-User Notifications. The flaw may allow a local user to gain higher privileges on the system.

Tanium addressed a local privilege escalation vulnerability in End-User Notifications. The flaw may allow a local user to gain higher privileges on the system.

Tanium addressed a local privilege escalation vulnerability in End-User Notifications. The flaw may allow a local user to gain higher privileges on the system.

Tanium addressed an unauthorized code execution vulnerability in Certificate Manager. Technical details were not disclosed in the description.

An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3, which uses a fixed and derivable cryptographic key. An unauthenticated attacker on the same local network may forge protocol packets and access privileged TDDP operations, including functionality that can lead to operating-system command execution.

By abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely because there is no automatic cleanup mechanism, leading to three distinct denial-of-service conditions that self-renew on a 24-hour cycle.

Asterisk prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3 contains a stack buffer overflow in the H.323 ooTrace() trace-logging function. An unbounded vsprintf writes into a fixed 2048-byte buffer, which can crash the Asterisk process when a crafted packet is sent.

Asterisk prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3 contains an unbounded memcpy of OGG/Speex packet data in format_ogg_speex. This can cause a heap buffer overflow and crash Asterisk when reading a file containing corrupted Speex audio.