CVE Vulnerability Catalog

BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability allowing attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. A crafted bentofile.yaml or imported bento archive can cause bentoml containerize to execute injected RUN instructions during docker build, accessing build secrets and poisoning images.

Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability allowing attackers to run shell commands through improperly escaped single quotes in format_command. A file with a crafted name containing an apostrophe can cause an action like the default edit action to execute commands with victim privileges.

RisingWave before 3.1.0 contains a missing authorization vulnerability allowing low-privileged SQL users to read and write arbitrary server files by creating posix_fs sources and fs sinks. Users holding schema CREATE privilege can set posix_fs.root or fs.path to any directory to read credentials and keys or write files as root.

Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Surfer: from n/a through 1.8.0.744.

A vulnerability was detected in D-Link E15, M32, R15 and R32 devices in the MQTT Broker component, involving hard-coded credentials in the /etc/emDaemon/passwd file. The attack can be launched remotely and a public exploit is already available.

A security vulnerability was detected in speaches-ai speaches up to 0.9.0-rc.3 in the PyannoteDiarizationModelManager._load_fn function of src/speaches/executors/pyannote_diarization.py. Manipulating the model argument leads to use of externally-controlled input to select classes or code, enabling remote attack; the exploit is publicly disclosed.

A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. This affects an unknown part of the file project.sql. Executing a manipulation can lead to files or directories accessible. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

A security flaw was discovered in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a involving missing authentication in multiple endpoints. The attack can be carried out remotely and the exploit is publicly available.

Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised_by value. Attackers can call the hd_ticket.api.new endpoint with a victim's email to plant phishing tickets in their portal and read their replies via get_ticket_activities.

Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. Attackers can call the add_note_to_call_log and add_task_to_call_log endpoints to attach attacker-written notes and tasks that appear on victims' call logs, leads, and deals.

Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. Attackers can query frappe.client endpoints filtering on to_user or call mark_as_read with another user argument to read, mark read, or delete others' notifications.

Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud metadata addresses to read internal responses via files written to the extension directory.

NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers to read local image files via unvalidated synced sourceUrl paths. Attackers with write access to the victim's sync target can plant absolute paths or file:// URLs, causing image_inspect to send local images to the AI provider.

Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/media_dirs because FileLibraryProvider.lookup() lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with file:// URIs to probe file existence, read tag metadata, and play out-of-sandbox files.

Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlisted endpoint, to read SSH keys, configuration, or notes.

KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. Attackers can host a page titled KitchenOwl at a URL matching /recipe/<id>. The follow-up requests.get() call can then be redirected or DNS-rebound to loopback, private-network, or cloud-metadata addresses, exposing internal services.

Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swarms and wiping recorded performance results.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Mailster WP Mailster wp-mailster allows PHP Local File Inclusion.This issue affects WP Mailster: from n/a through 1.9.1.0.

Improper Validation of Specified Quantity in Input vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a through 6.1.5.

Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1.