CVE Vulnerability Catalog

ServiceNow remediated a sandbox escape vulnerability in the ServiceNow AI Platform. An authenticated user with the admin role could bypass Rhino sandbox restrictions and execute arbitrary code on the underlying host operating system.

DB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py:129). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.

In the Botan C++ cryptography library, the C API function botan_block_cipher_block_size converted a size_t block size to int without a bounds check. In an application that accepts external algorithm parameter strings and uses FFI raw ECB mode, an attacker can select the variable-block-size Lion cipher, causing the reported size to be truncated, insufficient memory allocation, and later memory corruption. The issue is fixed in version 3.13.0.

In the Monkeytype repository, the .github/workflows/fix-formatting.yml workflow runs on pull_request_target with repository write permissions, checks out a fork pull request, installs dependencies from the fork's package.json, and invokes the fork-controlled oxfmt binary. Because actions/checkout persists the elevated GITHUB_TOKEN in Git configuration until after untrusted code executes, an external contributor can run arbitrary code, read or exfiltrate the token, and push repository content or modify pull requests and issues. The issue affects the repository CI workflow, not the Monkeytype application or user data, and is fixed in version 26.43.0.

Insecure permissions in Tailscale (versionCode 297862600) allow unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.

An issue in Shelter (versionCode 445) allows attackers to register their own auth_key and take over another user's binder service API and preference state.

An issue in AndBible (versionCode 1111) allows attackers to execute arbitrary code by uploading a crafted module zip.

IBM Langflow OSS versions 1.0.0 through 1.12.8 contain an improper authentication flaw that could allow a remote attacker to bypass security restrictions.

Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain an OS command injection vulnerability that could allow arbitrary command execution under certain configurations.

Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a path traversal vulnerability that could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.

Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain an OS command injection vulnerability that could allow arbitrary command execution with elevated privileges under certain configurations.

Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a path traversal vulnerability that could allow a delegated Host Administrator to access or modify files outside their authorized scope.

Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows have missing authorization in the administrative interface that could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.

Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows contain an improper authentication flaw that could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.

Zoho Flow versions up to and including 2.14.5 contain an unauthenticated PHP Object Injection vulnerability that could allow an attacker to manipulate objects within the application.

Gunslinger versions up to and including 1.11 contain an unauthenticated PHP Object Injection vulnerability that could allow an attacker to manipulate objects within the application.

Good Homes versions up to and including 1.3.13 contain an unauthenticated PHP Object Injection vulnerability that could allow an attacker to manipulate objects within the application.

PHP Object Injection vulnerability in the Gamic theme in versions up to and including 1.19. It can be exploited without authentication, allowing an attacker to inject a malicious PHP object.

PHP Object Injection vulnerability in the Gamezone theme in versions up to and including 1.1.11. It can be exploited without authentication, allowing an attacker to inject a malicious PHP object.

PHP Object Injection vulnerability in the EmojiNation theme in versions up to and including 1.0.12. It can be exploited without authentication, allowing an attacker to inject a malicious PHP object.