CVE Vulnerability Catalog

GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers to steal the gd_resource cookie by supplying attacker-controlled resource URLs in project files. Attackers can get victims to open a crafted project, causing downloadLocalFile() to send the cookie to their server and expose private cloud project resources.

A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. The same_check function in ipt_SAME.ko can lead to an integer overflow. The attack may be launched remotely.

In MemTensor memmy-agent up to 1.0.9/1.1.1/1.2.2, the requireAdminWrite function in Memory/src/server/http.ts causes resource consumption. The exploit is publicly available and attack complexity is high.

A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqli_error of the file Officers/addOfficer.php of the component Officer Registration Form; manipulation of the argument offName/offID/ID/contact/gender/weapon/role results in SQL injection. The attack can be initiated remotely, and the exploit is now public and may be used.

A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this issue is the function mysqli_query of the file Officers/searchOff.php of the component Search Page; manipulation of the argument Search leads to SQL injection. The attack may be performed from remote, and the exploit has been disclosed publicly and may be used.

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The endpoint blocklist does not cover /api/kernels, and the websocket wrapper previously tracked idle activity without authorizing executable messages.

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals therefore bypass the anonymous endpoint blocklist and reach Jupyter Server's terminal API. An unauthenticated attacker can use the resulting interactive operating-system shell to execute commands and access data available to the Mercury process.

FOSSBilling from 0.1.0 until 0.8.7 has an unauthenticated POST /api/guest/client/create endpoint that reveals whether a submitted email belongs to a registered client by returning a distinct unredacted error. An attacker can compare responses to determine if an email belongs to an existing client.

FOSSBilling from 0.1.0 until 0.8.7 has a path traversal vulnerability in the unauthenticated api/guest/system/template_exists endpoint because templateExists uses Path::join on the attacker-controlled file parameter without rejecting .. sequences or verifying the resolved path stays inside the active theme directory. An attacker can determine whether arbitrary files or directories exist on the server.

In FOSSBilling from 0.8.4 until 0.8.6, hasManagePermission fails open for inactive non-core modules, skipping access checks. A low-privileged staff account can read decrypted extension secrets and overwrite stored configuration of a deactivated module.

CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path as safe, so write_file follows the link and can write arbitrary files outside the workspace root. This issue is fixed in version 0.0.2.

Camunda 7.24.0 before 7.24.16 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled().

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the enableExpressionsInAdhocQueries restriction. Attackers can supply a malicious JUEL expression such as dueAfterExpression inside an orQueries entry to achieve arbitrary Java reflection and invoke java.lang.Runtime.exec, resulting in operating-system command execution as the engine service user.

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources. An authenticated attacker with no permission grants can access task comments and attachments and delete attachments by calling singular read and delete endpoints that lack the authorization-filtered checks enforced on their corresponding list endpoints.

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.6 allow a local authenticated user to run code as the mail server's high-privileged accounts when the product is installed in a folder whose permissions are inherited from a writable parent, such as the root of a drive. The installer places the server's programs in the Bin folder of the program folder and gives neither the program folder nor Bin any permissions of their own, so they inherit the parent's. Under the default location, Program Files, ordinary users receive only read and execute and the configuration is not affected; but the installer accepts any path without warning, and a program folder at the root of an NTFS volume inherits write access for a broad group - Authenticated Users (Modify) on a Windows client, Users (create files and folders) on Windows Server. A local user without administrator rights can then alter or replace the service program, which runs as LocalSystem or as the service's virtual account, or the programs an administrator runs elevated from Bin during setup and maintenance, or place a library in Bin that those programs load in place of the system copy, gaining code execution with those privileges. The default Program Files installation is not affected.

A vulnerability in hMailServer (versions 6.0.0 through 6.3.6) involves unchecked input for the X-hMailServer-LoopCount header, which is used to bound forwarding and auto-reply loops. An attacker can set a negative value (or one that overflows to negative), bypassing the limit and causing a message to loop up to about two billion times, filling the queue and disk and stopping mail service. Additionally, the Sieve notify action had no limit, and the counter could be reset via Sieve editheader or a rule Set header action.

Missing authorization in the Sieve notify action (versions 6.2.22 through 6.3.6) and in the mail-rule Reply action (versions 6.0.0 through 6.3.6) of Progressive Robot hMailServer allows an authenticated user to send mail through the server as any address. The server sets the From header to the :from value from the Sieve script or Reply action without verifying that the address belongs to the account. If the claimed address is at a domain hosted by the server with DKIM signing enabled, the message is signed with that domain's key, producing forged mail aligned to pass the domain's DMARC policy.

hMailServer 6.0.0 through 6.3.6 signs every message on its first delivery pass with the DKIM key of the hosted domain named in the From header, without checking the message origin or sender authentication. A remote unauthenticated attacker can therefore send a message with a forged From address at a hosted domain, have it signed with that domain's valid DKIM key, and upon forwarding (forward, alias, list, rule) have it pass DKIM and DMARC at external receivers.

Missing authorization in the Sieve editheader action (versions 6.2.22 through 6.3.6) and in the mail-rule Set header value action (versions 6.0.0 through 6.3.6) of Progressive Robot hMailServer allows an authenticated user to modify From, Sender, Resent-From, Resent-Sender, and DKIM-Signature headers and then redirect messages, causing the server to send mail as any address, DKIM-signed where the address is at a hosted domain. This enables forgery aligned to pass the domain's DMARC.

SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints in SLiMS Bulian 9.8.0 allows any authenticated staff user to extract arbitrary database contents.