CVE Vulnerability Catalog

In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured output can use the password to access the TLS client key.

An unauthenticated client that can reach a MongoDB Connector for BI deployment configured with Kerberos authentication may cause mongosqld to terminate when a crafted authentication exchange encounters a specific GSSAPI error-handling condition. This can interrupt BI Connector availability until the process restarts.

In wicked up to version 0.6.80, an out-of-bounds read exists in the DHCPv4 packet capture code. The function ni_capture_inspect_udp_header() incorrectly reports the payload length, causing the DHCPv4 client to read up to 68 bytes past the receive buffer. An unauthenticated attacker on the same network can cause adjacent heap memory to be interpreted as DHCP options.

In wicked up to version 0.6.80, an integer underflow exists in the DHCPv4 packet capture code. The function ni_capture_inspect_udp_header() does not verify that the IP total length field is at least as large as the IP header length before subtracting. An unauthenticated attacker on the same network can trigger an out-of-bounds read, potentially crashing the daemon.

The debug and test interface in Johnson Controls T2000 has improper access control, allowing access to functionality not properly constrained by ACLs. This affects T2000 versions before 31.6.

DoXBASE by BilPark has a cross-site scripting (XSS) vulnerability due to improper input neutralization during web page generation, allowing Cross Zone Scripting. This affects DoXBASE through 27082026.

Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Affected versions: Spring Framework 7.0.0 - 7.0.8, 6.2.0 - 6.2.19, 6.1.0 - 6.1.28, 6.0.0 - 6.0.30, 5.3.0 - 5.3.49, and 5.2.25.RELEASE and earlier.

Applications shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, are exposed to man-in-the-middle interception of every log event. Affected Spring AMQP versions: 4.1.0, 4.0.0-4.0.4, 3.2.0-3.2.12, and 2.4.18 and earlier.

Dool up to version 1.3.8 is vulnerable to CSV injection when exporting data to CSV, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a process with a crafted name starting with =, injecting malicious formulas into the CSV output that execute when opened in a spreadsheet.

Volmarg Personal Management System has a path traversal vulnerability allowing authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/{path} endpoint. The path parameter is passed directly to file_get_contents() without canonicalization against a permitted base directory, enabling access to sensitive files accessible to the PHP-FPM worker.

When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never checked, and a configured client certificate is not sent.

Seres Software syWEB has an observable discrepancy vulnerability allowing Account Footprinting. This affects syWEB through 27082026. The vendor was contacted and it was learned that the product is not supported.

Seres Software syWEB has a Reflected XSS vulnerability due to improper input neutralization during web page generation. This affects syWEB through 27082026. The vendor was contacted and it was learned that the product is not supported.

HCL IntelliOps Event Management (IEM) is affected by a Session Deletion Vulnerability. It may allow improper handling of user sessions, resulting in sessions not being fully terminated after logout or deletion.

Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar. The fix changes innerHTML to textContent.

Vulnerability in Flowintel allows JavaScript injection via malicious Mermaid blocks in case notes. An attacker with note creation or edit permissions can store a crafted payload that executes for other users.

Katello Content View Filter Rules API does not enforce authorization on the parent filter. A low-privileged user can access and modify filter rules in another organization.

Foreman template revision endpoint lacks object-level authorization. A low-privileged user can retrieve historical template contents from another organization or location.

claude-in-mobile 3.10.2 has an OS command injection vulnerability in execSync in src/adb/client.ts. The attack requires local access.

blackms aistack up to 1.6.1 has a path traversal vulnerability in the Static File Handler in src/web/server.ts. Manipulating req.url allows remote attacks.