CVE Vulnerability Catalog

A vulnerability was found in search-indexer that allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths do not properly restrict UPDATE/DELETE operations to data owned by the calling cluster.

RuoYi-Vue up to version 3.9.2 has a path traversal vulnerability in the fileDownload/resourceDownload function in CommonController.java. Manipulation of the fileName/resource argument allows remote attack, and the exploit has been made public.

An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting in full device compromise.

Coturn version 4.15.0 has a vulnerability that allows an authenticated TURN user to repeatedly resume allocations from fresh UDP 5-tuples without completing a handoff when --mobility is enabled. This leads to unbounded server-side sessions and process memory exhaustion even with --user-quota=1 configured.

Coturn before version 4.15.0 has a vulnerability where an unauthenticated client can send a STUN message over TCP/TLS with a body-length field from 65520 through 65532, causing the len variable in stun_get_message_len_str() to wrap. This leads to desynchronization of the stream parser and drops the attacking client's connection, but does not affect other clients or the server process.

Lemmy-ui before version 0.19.19-beta.1 renders Markdown without sanitization, allowing HTML injection and JavaScript execution in the lemmy-ui origin. An approved member or a remote federated instance can store malicious content, and a viewer who renders it may execute script, potentially exposing the viewer's session and authenticated actions.

Lemmy before versions 0.19.19 and 1.0.0-alpha.18 does not check the block list when editing private messages. A blocked sender can still edit old messages that the recipient can see, enabling post-block harassment.

Lemmy before versions 0.19.19 and 1.0.0-alpha.18 allows a lower-ranked moderator to remove a higher-ranked moderator by sending a signed ActivityPub Remove activity. The verification does not check moderator rank, enabling a junior moderator to strip senior moderators from the community moderator list.

Lemmy before versions 0.19.19 and 1.0.0-beta.1 returns different errors during login depending on whether the username or email exists. A nonexistent account returns 404, while an existing account with a wrong password returns 400. This discrepancy allows an unauthenticated attacker to confirm registered usernames or email addresses.

Lemmy before versions 0.19.19 and 1.0.0-beta.1 uses the first X-Forwarded-For value as the client address for rate limiting. The bundled nginx config appends the real client address to a client-supplied value, allowing an attacker to spoof the address and bypass limits on multiple API endpoints.

Koel before version 9.7.1 incorrectly treats NAT64 and 6to4 addresses as public, allowing an authenticated user to place such an address in a podcast RSS and trigger requests to internal services or cloud metadata. The response body is returned to the user.

Koel before version 9.7.0 in the Subsonic createPodcastChannel.view route does not apply SafeUrl validation, allowing an authenticated user to provide a private URL. This causes immediate server-side requests to loopback, Docker bridge, or RFC1918 destinations.

IBM PowerVM Hypervisor in certain firmware versions allows a local attacker with administrative privileges to decrypt encrypted data because some hypervisor calls use less entropy than requested.

IBM PowerVM Hypervisor Platform KeyStore (PKS) and virtual TPM in certain firmware versions use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC can exploit this to derive the encryption key and access data.

IBM OpenBMC FW1060.00 through FW1060.80 is affected by a vulnerability in the BMC firmware update process. An attacker with authenticated administrator-level access can execute arbitrary code under specific conditions, impacting confidentiality, integrity, and availability.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service and obtain sensitive information due to an out-of-bounds read.

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.

IBM Reliable Scalable Cluster Technology (RSCT) 3.0 could allow a remote attacker to cause a denial of service by sending a specially crafted request due to improper input validation.

A vulnerability in the NVS backend of the Zephyr settings subsystem (settings_nvs.c) causes an out-of-bounds stack write. The nvs_read() function returns the full entry length, which can exceed the buffer size, and the code uses this value as an index for writing a NUL character, leading to a write past the buffer (CWE-787).

A vulnerability was detected in pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function _transformPHP of the file classes/xslt/XSLTransformer.php. The manipulation results in XML external entity reference. The attack can be executed remotely. Upgrading to version 3.3.0-23, 3.4.0-11 and 3.5.0-5 is sufficient to fix this issue.