CVE Vulnerability Catalog

In Joomla extension SP Page Builder before 6.8.0, an unauthenticated attacker can create comments even when guest commenting is disabled by overriding the setting with user-supplied input.

In Joomla extension SP Page Builder before 6.8.0, an unauthenticated attacker can create arbitrary directories and files with a predefined name.

An authenticated user may write files outside the intended Artifactory work directory under specific conditions.

A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.

An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.

An authenticated user may view private Puppet module metadata without repository read access.

An authenticated user without repository read permission may access private NuGet metadata under specific conditions.

An unauthenticated user may access restricted repository information under specific conditions.

Credentials for a deleted user may remain valid for a short period under specific conditions.

regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. Version 0.11.5 fixes the issue.

Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::setCookie()` logs full cookie values and `Session::start()` logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent auto-login cookie. Anyone with access to the log sink can recover live bearer-style credentials from the logs. Version 5.0.10 contains a fix.

Admidio is an open-source user management solution. Version 5.0.9 added a missing `isAdministratorInventory()` gate to `case 'item_delete':` in `modules/inventory.php`. The same fix was not applied to the sibling `case 'field_delete':` handler, which destroys an entire inventory field definition, cascading to every `adm_inventory_item_data` row that referenced that field and every `adm_inventory_field_options` entry. The handler validates only a session-bound CSRF token; there is no `isAdministratorInventory()` check at the controller level, and `Admidio\Inventory\Entity\ItemField::delete()` does not enforce one at the entity level either (unlike its sibling `ItemField::save()`, which does check `$gCurrentUser->isAdministrator()`). Any user who can log in to the site can permanently destroy a non-system inventory field by sending one POST. Version 5.0.10 provides an updated fix.

Docker Sandboxes (sbx) applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode. The directory stays writable at its shared-export path, so unprivileged code inside the sandbox can derive that path and write to a host directory the operator attached read-only.

A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offset, resulting in an out-of-range substring operation. A malicious actor may leverage this vulnerability to cause the NT AUTHORITY\SYSTEM service to terminate unexpectedly, resulting in a denial-of-service condition.

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 stores TPM2.0 secrets in a serialized format within unused disk sectors. An unauthenticated attacker with physical access to the system disk can recover this information and craft an environment to unseal the TPM.

Admidio prior to version 5.0.10 has a CSRF vulnerability in the `mode=export` action in `modules/sso/keys.php`, which exports a PKCS#12 bundle with the private key and certificate. The CSRF validation line is commented out, allowing a forged cross-site POST from an administrator session to trigger private key export without a valid form token.

Admidio prior to version 5.0.10 has an IDOR vulnerability in `modules/documents-files.php` in the `file_rename_save` mode. The top-level rights check validates upload rights on the `folder_uuid` parameter, but the rename operation acts on `file_uuid` without re-checking the actual containing folder. A user with upload rights on any folder A can rename a file in folder B as long as they can view it.

Admidio prior to version 5.0.10 lacks CSRF token validation in `modules/sso/clients.php` for the `enable` action. The `enable` case loads the SAML or OIDC client by UUID, calls `$client->enable($enabled)`, and persists the new state with no token check. Because the action is reachable via plain GET parameters, a third-party page can trick an authenticated administrator into disabling or re-enabling any configured SAML or OIDC client.

Admidio prior to version 5.0.10 lacks CSRF token validation in `modules/registration.php` in the `send_login` mode. This mode regenerates a random password for `user_uuid_assigned`, stores its bcrypt hash, and emails the cleartext to that user. Other state-changing modes in the same file check the CSRF token, but `send_login` does not. A page visited by a registration-administrator can issue the request as a top-level navigation, and the browser sends the admin's `SameSite=Lax` cookies, allowing password reset without admin interaction.

Admidio prior to version 5.0.10 has a vulnerability in `modules/categories.php` where the per-category permission check is dead code because it compares `$getType` (a category-type code) against mode names (`edit`/`save`/`delete`), which is permanently false. Consequently, the `delete`, `sequence`, and `save` cases load the category by UUID and act on it without re-checking that the category belongs to a module the actor administers. A user with only one module-administrator right can destroy or reorder empty categories belonging to other modules.