CVE Vulnerability Catalog

Exposure of the SQL Black List to an unauthorized actor vulnerability in Apache Kylin. The issue affects versions from 4 through 5.0.4.

Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. The issue affects versions from 4 through 5.0.4.

Exposure of Job Discard to an unauthorized actor vulnerability in Apache Kylin. The issue affects versions from 4 through 5.0.4.

Improper Authentication vulnerability in Apache Kylin. An unauthenticated user may access system cleanup actions. The issue affects versions from 4 through 5.0.4.

Exposure of Sensitive Information to an unauthorized actor vulnerability in Apache Kylin. The issue affects versions from 4 through 5.0.4.

Tandoor Recipes before 2.6.12 allows an authenticated user with read and write API scope in the victim's Space to access and modify another same-Space member's private recipe steps. The flaw is because StepViewSet and IngredientViewSet filter only by active Space and use role-level checks instead of the private-recipe owner or sharing predicate.

Tandoor Recipes before 2.6.10 passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks. An authenticated user can create a Space, configure an AI provider with a URL targeting an internal address, and invoke an AI action, enabling scanning of internal hosts and ports.

Tandoor Recipes prior to version 2.6.10 executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or an execution timeout. When an authenticated user stores a catastrophic-backtracking regex and any user in the same Space imports a matching recipe, the automation engine can occupy a Gunicorn worker until its request timeout, exhausting worker slots and making the service unavailable.

Tandoor Recipes before 2.6.10 allows an authenticated member of a shared Space to access another member's private recipes by supplying a private recipe identifier to AI import, file, external-link, or share-link endpoints. The flaw is due to missing object-level authorization, potentially leading to reading private recipe files, sending them to the AI provider, or creating public links.

ZoneMinder prior to 1.39.2, 1.38.2, and 1.36.40 interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths. An authenticated user with monitor-create or monitor-edit permission can save a Local monitor whose Device Path contains shell metacharacters, leading to arbitrary command execution as the web server user.

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. The issue affects versions from 4.0.4 through 5.0.4.

Authentication bypass within in-house network in Apache Kylin. The issue affects versions from 4.0.4 through 5.0.4.

JavaCV prior to 1.5.14 has IPCameraFrameGrabber doubling a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length. A malicious MJPEG camera endpoint can return an oversized Content-Length header, trapping the frame-grabbing thread in a CPU-spinning loop and causing denial of service.

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user.

ZoneMinder prior to 1.38.3 concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters in exportEvents(). An authenticated user with View Events or View Snapshots permission can submit a crafted export request and execute arbitrary OS commands as the web server user.

A flaw was found in libtirpc involving unbounded decoding of PMAPPROC_DUMP replies. A remote attacker can send specially crafted replies to a client application using the pmap_getmaps() function against an attacker-controlled host, causing excessive memory and CPU allocation and a denial of service (DoS) in the client process due to resource exhaustion.

A flaw was found in libtirpc allowing an authenticated remote attacker to send oversized wrapped data requests to an RPC service configured with RPCSEC_GSS integrity or privacy. This leads to unbounded memory allocation and a denial of service (DoS) by exhausting system resources, causing the service to become unstable or terminate.

IBM i versions 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper enforcement of the ChrootDirectory configuration directive.

IBM i versions 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper validation of attacker-supplied transaction identifiers.