CVE Vulnerability Catalog

In Shopper before 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make('delete') and DeleteBulkAction::make() without delete_collections authorization, while public Collection $collection remains client mutable because it lacks the Livewire Locked attribute. An authenticated staff user with only browse_collections can invoke a Livewire removal action, substitute an arbitrary collection identifier, and detach selected products or empty the collection. This can disrupt catalog landing pages and promotions associated with the targeted collection. Fixed in version 2.9.2.

In Strimzi 1.0.0 and earlier, an attacker who can create a Kafka custom resource can set Kafka.spec.entityOperator watchedNamespace to a target namespace, causing the Cluster Operator to create a Role with full Secret CRUD permissions there and bind it to the Entity Operator ServiceAccount in the attacker's namespace. The attacker can mint a token for that ServiceAccount and read or write Secrets in any target namespace where the Cluster Operator has been granted permissions, regardless of STRIMZI_NAMESPACE. Fixed in versions 1.0.1 and 1.1.0.

In Meta Ads MCP before 1.0.115, the upload_ad_image tool in meta_ads_mcp/core/ads.py passes an attacker-controlled image_url to try_multiple_download_methods() in meta_ads_mcp/core/utils.py, where httpx.AsyncClient uses follow_redirects=True and performs HTTP requests without validating the scheme, host, or resolved IP address. In a streamable-http deployment, a network caller can use any non-empty authorization value because Meta credential validation occurs after the image download, then direct the server to loopback services, private-network addresses, cloud metadata endpoints, or redirect-chained internal targets. The resulting server-side request forgery can expose internal data, invoke state-changing internal services, or disrupt reachable services. Fixed in version 1.0.115.

Meta Ads MCP prior to version 1.0.115 contains a flaw in AuthInjectionMiddleware that rejects HTTP requests only when both tokens are absent, while extract_token_from_headers() does not recognize X-Pipeboard-Token as a primary credential. A remote caller using the streamable-http transport can send any X-Pipeboard-Token value, bypass the guard, and cause the server to fall back to the operator's META_ACCESS_TOKEN.

netty-incubator-codec-ohttp prior to 0.0.23.Final allocates a pooled direct ByteBuf for decrypted plaintext before the AEAD tag is verified. When an invalid tag causes a CryptoException, the buffer is not released, leading to native off-heap memory leaks on repeated invalid requests.

MitraStar GPT-2742GX4X5v6-SV version GL_g2.5_100XNT0b23_3 contains a vulnerability in the /cgi-bin/device-management-utilities-internet.cgi component that allows an authenticated attacker to execute arbitrary code.

OpenCost prior to 1.121.0 exposes the POST /serviceKey endpoint, allowing a network client to invoke AddServiceKey without mandatory authentication and write an arbitrary key value to the GCP service-account key.json file. The attacker controls the file contents but not the directory, filename, or file mode.

CrowdStrike released a security update for the Falcon sensor for Windows addressing a vulnerability that exists only when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled. The vulnerability could expose an arbitrary file write to protected locations from an unprivileged context, potentially leading to local privilege escalation.

Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edit_user_properties permissions on the REST API user write endpoints (PUT /ccm/api/1.0/users/{uID} and POST /ccm/api/1.0/users/{uID}/change_password). A user with an update-scoped OAuth token and permission to edit only one field could change another non-superuser's password, username, email, and attributes, taking over that account.

In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page. A user who could create or rename pages could store a script through a child page name that would run in the browser of any visitor, editor, or administrator viewing the navigation.

GitLab CE/EE versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 contain a vulnerability that under certain conditions allows an authenticated user to access CI/CD variables outside their intended environment scope. The cause is improper input validation in the environment scope pattern matcher.

IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

IBM MQ versions 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain a deserialization of untrusted data vulnerability. An authenticated attacker could exploit it to execute arbitrary code.

IBM MQ versions 9.1, 9.2, 9.3, 9.4, and 10.0 contain a vulnerability due to improper handling of XML external entities during RFH2 folder parsing. An authenticated attacker could read files from a vulnerable .NET client or cause a limited denial of service.

IBM MQ versions 9.1, 9.2, 9.3, 9.4, and 10.0 (Classes for Java) contain an XML External Entity Injection vulnerability in MQRFH2 header processing. An authenticated attacker could obtain sensitive information or cause a denial of service.

IBM Verify Identity Access contains a vulnerability due to insufficient validation of incoming request resources. A remote attacker could cause a denial of service.

IBM MQ versions 9.1, 9.2, 9.3, 9.4, and 10.0 contain a vulnerability due to insufficient input validation, enabling JNDI injection attacks. This could lead to information disclosure or remote code execution.

IBM MQ versions 9.1, 9.2, 9.3, 9.4, and 10.0 contain a vulnerability due to improper validation of JNDI names in the Resource Adapter Installation Verification Test application. An authenticated attacker could execute arbitrary code on the application server.

IBM MQ versions 9.1, 9.2, 9.3, 9.4, and 10.0 contain a vulnerability due to improper validation of deeply nested certificate data during TLS certificate processing. A remote attacker with a trusted TLS client certificate could cause a denial of service and potentially affect memory contents.

IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied requests.