CVE Vulnerability Catalog

IBM Verify Identity Access contains a vulnerability due to improper validation of user-supplied input. An administrator could execute additional commands they are not entitled to.

IBM Security Verify Identity Access Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user-supplied data.

IBM Verify Identity Access contains a vulnerability due to insufficient validation of incoming request resources. A remote attacker could cause a denial of service.

IBM MQ versions 9.1, 9.2, 9.3, 9.4, and 10.0 contain a vulnerability due to unsafe deserialization that enables JNDI injection attacks. An authenticated attacker could execute arbitrary code in client applications.

A heap buffer overflow vulnerability in IBM MQ occurs when receiving messages from a malicious queue manager or through a man-in-the-middle attack. It affects multiple LTS and CD versions, including 9.1, 9.2, 9.3, 9.4, and 10.0.0.0. It could allow a remote attacker to cause a denial of service or potentially execute arbitrary code in the client.

A vulnerability in the Prolink 13A Smart Plug (model DS-3202M-UKv3, app version mEzee 2.6.7) allows an attacker to cause a Denial of Service (DoS) or connect to an attacker-controlled device by supplying a crafted packet during the provisioning phase. This requires network access during device configuration.

A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224. The impacted element is the function exportOvpn of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user of the component Export Ovpn Handler. The manipulation of the argument filetype leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows unauthenticated attackers to sign in as arbitrary users by authenticating through a different social provider sharing the same driver_id namespace. Attackers can authenticate at one enabled social provider using a user ID that matches an account linked to a different social provider, bypassing credential verification entirely because the SocialAuthService::handleLoginCallback query ignores the driver column when retrieving linked account records.

In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID[] without validating them as integers, and when the block was configured with setMode set to any it concatenated each stored identifier directly into the file-set filter query instead of casting it or binding it as a parameter. An authenticated user permitted to add or edit a Document Library block could therefore persist SQL syntax in the block configuration (btDocumentLibrary.setIds), and that stored expression was executed every time the published page containing the block was rendered, producing stored, time-based blind SQL injection.

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4, agentConn.apiClient() follows redirects while its custom transport accepts the host from the redirected request URL when the port is the workspace agent HTTP API port 4. An authenticated user who controls a modified workspace agent and knows another online agent's UUID can derive the victim's tailnet address and redirect control-plane requests to that agent. HTTP 301, 302, and 303 redirects can redirect read requests, while HTTP 307 and 308 preserve replayable write and process-start requests. The redirected workspace agent file APIs can read or write files as the victim workspace user, and affected versions exposing the workspace agent process API can execute commands after a redirected file write, crossing workspace and tenant boundaries. This issue is fixed in versions 2.29.19, 2.32.9, 2.33.10, and 2.34.4.

Yeger is a monorepo for npm packages maintained under the yeger scope. Prior to 2.8.9, the turbo-graph package starts its embedded Next.js server from packages/turbo-graph/src/index.ts on all interfaces, including 0.0.0.0:29312 by default, while the GET handler for /api/run in packages/turbo-graph-ui/app/api/run/route.ts has no authentication, authorization, CSRF protection, or task allowlist. The handler accepts the tasks, filter, and force query parameters, and buildResponseFromArgs passes attacker-selected task names to spawn() as Turbo CLI arguments. An adjacent-network attacker can execute any task defined in the victim repository's turbo.json with the privileges of the developer OS user, potentially exposing secrets, modifying files or infrastructure, or causing destructive availability effects. The use of an argument array prevents traditional shell metacharacter injection but does not prevent unauthorized execution of defined tasks. This issue is fixed in version 2.8.9.

In the Lokka-Microsoft tool (an MCP server for Microsoft 365) prior to 2.1.2, a user-controlled path value is directly concatenated to the management.azure.com base URL. A specially crafted path can alter URL authority parsing and cause an Azure Resource Manager bearer token to be sent to an unintended host.

The @jhb.software/payload-cloudinary-plugin from 0.3.0 until 0.4.0, with clientUploads enabled, exposes POST /api/cloudinary-generate-signature, which passes attacker-controlled parameters directly to Cloudinary's signing function without any restrictions. Any authenticated Payload user can obtain a valid HMAC-SHA1 signature for unauthorized parameters such as overwrite, type, notification_url, invalidate, folder, and public_id.

The EmbedVideo extension for MediaWiki prior to 4.1.0, with the default $wgEmbedVideoRequireConsent configuration, places JSON into the data-mw-iframeconfig attribute without safely escaping single quotes. Attacker-controlled archiveorg identifiers and wistia or sharepoint URLs can terminate the attribute and inject event-handler attributes into the generated figure element.

The EmbedVideo extension for MediaWiki prior to 4.1.0 passes the user-supplied class value directly to sprintf when constructing a figure element. A quote in the class value can terminate the class attribute and inject arbitrary HTML attributes or markup into the rendered page.

The EmbedVideo extension for MediaWiki prior to 4.1.0 interpolates an attacker-controlled unknown service name into exception text, then returns that text as HTML without neutralization. Both the #ev parser function and the evl parser form can reach this error path.

Vouch Proxy prior to 0.48.0 parses the total part count from an attacker-controlled multipart cookie name and passes it to make([]string, numParts) without checking that the value is positive or reasonably bounded. A cookie name such as VouchCookie_1of10000000000 causes an attempted allocation of roughly 160 GB and a fatal Go out-of-memory condition.

A High severity Denial of Service (DoS) vulnerability in Confluence Data Center versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0. An authenticated attacker can cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network.

A High severity Improper Authorization vulnerability in Jira Service Management Data Center version 11.3.0. An authenticated attacker can gain unintended access, potentially leading to exposure of resources or functionality, and possibly enabling sensitive information disclosure or arbitrary code execution.

A High severity Improper Authorization vulnerability in Confluence Data Center versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0. An authenticated attacker can gain unintended access, potentially leading to exposure of resources or functionality, and possibly enabling sensitive information disclosure or arbitrary code execution.