CVE Vulnerability Catalog

kiwilan php-archive up to 2.3.02 has a path traversal vulnerability in ArchiveZip::extract in src/Readers/ArchiveZip.php. The attack can be carried out remotely and a public exploit is available.

A security flaw was discovered in orbitale imagemagick-php up to version 3.3.5. The Command::font function in src/Command.php is affected; manipulation of the fontFile argument results in OS command injection. The attack can be executed remotely, the exploit has been released publicly and may be used in attacks, and the vendor did not respond to the disclosure.

DiffSK configobj up to 5.0.9 has an inefficient regular expression complexity vulnerability in _sectionmarker in configobj/__init__.py. Remote exploitation is possible.

smrealms smr up to commit f40380c has a server-side request forgery vulnerability in isUrlReachable in src/pages/Account/AlbumEditProcessor.php via the Website argument. The attack can be launched remotely and the exploit is publicly disclosed.

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the file_etag option is not set, the ETag is built from the file's inode number, modification time and size.

Dell Application Store versions prior to 26.05.0.7 contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to arbitrary code execution.

Dell Application Store versions prior to 26.05.0.7 contain an Uncontrolled Path Element vulnerability. A low-privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege and arbitrary code execution.

Dell Application Store versions prior to 26.05.0.7 contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low-privileged attacker with local access could potentially exploit this vulnerability, leading to disclosure of sensitive information.

Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contain a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit when system.images.url_actions is enabled. Attackers can send single-dimension or percentage forceResize, zoomCrop, or chained image actions to make GD allocate multi-gigabyte canvases, exhausting server memory and taking the site down.

Grav from 2.0.0 before 2.2.2 allows page editors to read protected configuration by adding config-*@ directives to page frontmatter forms. Attackers with page-edit permission can bypass the Twig sandbox config_denied_paths redaction to expose security.salt, plugin credentials, and Redis passwords to all visitors.

Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-*@ directives past the callable check to invoke Folder::delete, Folder::move, or Utils::download, deleting directories, overwriting files, or reading files.

Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/{lang} endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy endpoints. Unauthenticated attackers can send small requests that each store about 560 KB to exhaust disk or APCu, while accounts with api.pages.write can overwrite translations or create pages that page-level rules deny.

Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider. Attackers able to create or update Ingress or Service resources in one namespace can set router.middlewares or service.serverstransport annotations to obtain another tenant's injected credentials or reuse its client certificates.

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contain a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObject via a lowercase class name to read .env secrets or write a PHP file into the webroot for remote code execution.

Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries, categories, tags, and assets shared across sites.

Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.

Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability. An authenticated administrator can inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout(), with 'as X' or 'on X' keys bypassing cleanseConfig().

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability. An authenticated Control Panel user can escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners and injecting Yii 'as' or 'on' config keys.

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability. An authenticated Control Panel user can escape the Twig sandbox via Asset::getMimeType transforms by supplying 'as' or 'on' keys passed unfiltered to Craft::createObject.

Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contain a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue() without consulting the sandbox security policy. Authenticated Control Panel users can supply dot-path keys to traverse the craft global and disclose the securityKey, database credentials, and auth tokens.