CVE Vulnerability Catalog

@fastify/cors is the CORS plugin for the Fastify web framework. In versions 8.2.0 through 11.3.x, an application that registers the plugin with the non-default onSend hook option crashes on a CORS preflight. On an OPTIONS request carrying the Origin and Access-Control-Request-Method headers, the plugin calls reply.send from inside the onSend hook and re-enters the send pipeline, so a second write of the response headers throws an uncaught ERR_HTTP_HEADERS_SENT that can terminate the Node.js process when no process-level handler is installed.

@fastify/http-proxy versions 11.6.0 through 11.6.2 normalize literal backslashes before percent-decoding the request path, so a path encoding backslashes and dot-segments survives the dot-segment check and only becomes backslash and double-dot sequences afterward. When the upstream treats backslash as a path separator, the forwarded request walks out of the configured proxy prefix and reaches a sibling upstream location.

@fastify/http-proxy versions 9.0.0 through 11.6.5 substitute URL-decoded route parameters into rewritePrefix without re-encoding them. A parameter value encoding a path separator with a fragment or query delimiter decodes into real separators, injecting extra upstream path segments and stripping the mandatory suffix. An unauthenticated remote attacker can reach upstream locations outside the intended prefix, leading to path-restriction bypass and, depending on the upstream, SSRF or authorization bypass.

@fastify/secure-session versions 7.5.0 through 8.4.1, when configured with the signed cookie option, calls the cookie unsign routine but still passes the original cookie value to the session decoder when the signature check reports it invalid, so a session with an invalid signature is decrypted anyway. This matters when an application uses a signing secret separate from the encryption key and rotates only the signing secret to retire sessions while keeping the encryption key active.

@fastify/multipart versions 5.3.0 through 10.1.6 does not propagate a parser error to the file stream when a request body ends inside a file part with no closing boundary, even though Content-Length is complete, the client does not abort, and no file size limit is exceeded. The plugin destroys the in-progress file stream without an error, so a handler doing asynchronous work before consuming the file attaches to a stream that never emits an error or end event, and the request never responds.

@fastify/reply-from versions up to and including 12.8.0 validate proxy paths only against forward-slash dot-segments, then build the target with the WHATWG URL parser, which normalizes backslash and its percent-encoded form to a forward slash. A path using backslash dot-segments bypasses the traversal check and resolves to a different upstream path. An unauthenticated request can escape the intended prefix and reach other upstream endpoints.

The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to inject malicious scripts. This can be exploited by uploading a crafted SVG file that is stored and rendered by the application. Consequences include redirecting the victim's browser to an arbitrary website, modifying the page UI, or retrieving browser information, though impact is mitigated as sensitive session cookies are protected with the httpOnly flag.

The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that redirects users to an arbitrary external domain. By leveraging this open redirection vulnerability, an attacker can craft a malicious link that redirects users to an attacker-controlled page.

When an Event Publisher output adapter is configured with properties irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confidential information depending on the nature of the misconfigured property.

SQL injection vulnerability classified as an internal threat level. Attackers can steal database information via SQL injection while logged in.

The affected component fails to enforce expected validation constraints on the 'content-type' header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated 'content-type' header.

The user search function within the management console fails to properly encode user-supplied input before rendering it in the browser. This allows an attacker to inject malicious scripts that are then executed by the user's browser in the context of the management console.

A memory corruption vulnerability exists in the QMqttClient class of the Qt MQTT module. Under certain MQTT 5 connection settings between client and server, QMqttClient may corrupt memory, which can cause the application to crash.

Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an authenticated Remote Code Execution vulnerability. The flaw requires authentication but allows arbitrary code execution on the server.

The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state. This allows unauthenticated attackers to forge a payment confirmation and mark any order as paid without payment.

Permission control vulnerability in the Bluetooth module. Successful exploitation of this vulnerability may affect availability.

Permission control vulnerability in the autofill service module. Successful exploitation of this vulnerability may affect service confidentiality.

XunRuiCMS (dayrui) through version 4.7.4 has a flaw in the str_replace function in /var/www/html/zzmob/index.php within the Mobile Site Directory component. Manipulation of the dirname argument results in code injection, and the attack can be launched remotely.

A Denial of Service (DoS) vulnerability was found in the window module. Successful exploitation may affect service availability.

An out-of-bounds read (OOB read) vulnerability was found in the peripheral module. Successful exploitation may affect service confidentiality.