CVE Vulnerability Catalog

A vulnerability in Kimai before version 2.64.0 in the ProjectViewController export route (report_project_view_export) is due to missing authorization. The authorization guards are attached to the sibling __invoke method rather than at the class level, so the export route inherits no authorization checks. Any authenticated user, including a plain ROLE_USER without the project_reporting permission, can download the project overview export - which returns the same dataset as the protected report - disclosing customer names, project names, currency, budget type, and aggregate totals across all customers. Actual financial figures remain protected in the export template.

LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor.ExtractToDir in internal/importer/zip_extractor.go opens each entry and copies it to the destination with io.Copy, which runs to the end of the decompressed stream, so only the size of the uploaded archive is bounded and the size it expands to is not. The import route that reaches this code requires the Editor or Admin role, and the upload itself is capped at 500 MiB compressed. Because a ZIP entry can compress at a very high ratio, an archive well inside that cap can expand to hundreds of gigabytes as it is written out. The extraction directory defaults to a location under the operating system temporary directory, so the written data consumes the disk backing that path, which on a tmpfs-backed temporary directory is memory. A user holding the Editor role can therefore exhaust the storage the service depends on and keep it from serving, using far more resource than the upload limit alone would permit.

CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written to a dictionary file.

Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be executed within the affected application.

Doorkeeper OpenID Connect prior to 1.10.4 does not validate client-supplied scopes during Dynamic Client Registration (DCR). This allows a self-registered client to obtain scopes beyond what the server intended to grant, leading to privilege escalation.

Drupal core has a Stored XSS vulnerability due to improper neutralization of input during web page generation. Affected versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, and some 11.0.*, 11.1.*, 11.2.* versions.

Doorkeeper version 1.9.0 has a vulnerability that allows an attacker who knows only a dynamically registered client's client_id, which is public, to authenticate as that client at the token endpoint and obtain an access token without providing its client_secret. This occurs because Dynamic Client Registration creates applications with confidential: false hard-coded, even though the registration response returns a client_secret and advertises support for client_secret_basic and client_secret_post. Only projects with Dynamic Client Registration enabled (disabled by default) are affected.

The Drupal Powerful Surveys module has an unspecified vulnerability. Affects all versions.

The Disable Login Page module for Drupal has a vulnerability of improper restriction of excessive authentication attempts, allowing brute force attacks. Affects versions from 0.0.0 to 1.1.4.

The Drupal PanKM module has an unspecified vulnerability. Affects all versions.

Vulnerability in Drupal Lunr exposed filters. This issue affects all versions.

Vulnerability in Drupal Email Login OTP. This issue affects all versions.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects versions from 0.0.0 to 1.12.0.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects versions from 0.0.0 to 1.0.8.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, and all versions up to 11.2.*.

Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects versions: up to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, and all versions up to 11.0.*, 11.1.*, and 11.2.*.

Vulnerability in Drupal Development Environment. This issue affects all versions of this environment.

BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSocket session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended.

TypeBot prior to 3.18.0 has a vulnerability that allows any authenticated non-guest workspace member to remove another workspace's public custom domain and make typebots on that domain unavailable. The custom-domain delete handler authorizes a caller against a client-supplied workspaceId but sends the client-supplied domain name to the shared Vercel project before verifying that the domain belongs to that workspace.