CVE Vulnerability Catalog

Improper authentication in the agent receiver of Checkmk before 2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and availability. Only Cloud, Ultimate, and Ultimate MT editions are affected.

A vulnerability was identified in CodeAstro Online Job Portal 1.0 in the file /users/update-profile.php. Manipulation of the Name argument leads to unrestricted upload. The attack can be initiated remotely, and the exploit is publicly available.

Applications using Micrometer Tracing with W3C baggage propagation in the Brave bridge are vulnerable to denial of service (DoS) due to unbounded object allocation when extracting incoming baggage headers. Affected versions: Micrometer Tracing 1.7.0, 1.6.0-1.6.6, 1.5.0-1.5.12, and 1.4.13 and earlier.

A vulnerability in misp-stix allows an attacker to supply a crafted STIX document that can influence security-sensitive MISP attribute metadata during import. The parser selection was based on untrusted indicators (tool labels or document title), enabling spoofing of MISP-origin content. Additionally, attributes from x-misp-object were copied without restrictions, allowing injection of unexpected fields.

@fastify/busboy is a multipart form-data parser for Node.js. Its part-header parser splits lines only on CRLF, so a lone CR or LF in a header is not treated as a line break and is passed verbatim to the filename and field name. An attacker can inject control characters, leading to filesystem filename pollution, log forging, or header injection. Versions up to 3.2.1 are affected; fixed in 3.2.2.

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check but fail to honor its result correctly, allowing any authenticated user to write and read annotations on entities they don't own. Affects versions from 4.15.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries. Affects versions from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size before URL validation. Affects versions 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality. Affects versions from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Cross-site scripting vulnerability in Miraikan Assist App. Exploitation may allow arbitrary script execution in the WebView component, altering displayed content.

Missing authentication for critical function vulnerability in IKAS Technology Inc. Rush allows Fake the Source of Data. This issue affects Rush through 21082026. The vendor was contacted and it was learned that the product is not supported.

The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs, changing a WooCommerce order's status based solely on an attacker-supplied numeric order id. An unauthenticated attacker can cancel or fail arbitrary orders store-wide by enumerating ids, triggering downstream stock-release and notification side-effects.

The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection.

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict access to per-vendor commission configuration returned by one of its unauthenticated store REST endpoints, allowing any unauthenticated user to disclose a vendor's commission type and, when category-based commission is configured, the per-category and default commission rates.

The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks.

The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only.

The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account after the victim logs in through an attacker-crafted request.

In Rocket.Chat before versions 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the DDP methods getThreadsList and getThreadMessages accept raw, untyped parameters. A MongoDB operator object can be substituted for a string room-id or message-id, leading to disclosure of private thread parents and their full reply content to any low-privilege authenticated user.

Software installed and run as a non-privileged user may conduct GPU system calls which cause GPU memory leaks and possible kernel heap corruption. This is caused by memory free paths not maintaining state data of upgraded higher order allocations, potentially leading to memory leak or double free.

Use of hard-coded credentials issue exists in VOCALOID6, which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain access to Yamaha's activation and content servers.