CVE Vulnerability Catalog

In RustFS prior to 1.0.0-beta.12, an anonymous ListObjectVersions request that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and returns before the policy_allowed path applies deny_anonymous_table_data_plane_if_needed and RestrictPublicBuckets. This allows a bucket that permits anonymous listing to continue exposing version listings after an operator enables public-access control.

In RustFS prior to 1.0.0-rc.1, Object Lock enforcement lets check_object_lock_for_deletion, delete_prefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin data, or unparseable metadata as no lock configuration, allowing objects under COMPLIANCE retention to be deleted or expired.

In RustFS prior to 1.0.0-beta.12, FTPS MKD handling in FtpsDriver::mkd calls storage.create_bucket without authorize_operation for S3Action::CreateBucket, allowing authenticated FTPS users denied s3:CreateBucket to create buckets.

In RustFS, explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy sources are authorized with s3:GetObject instead of s3:GetObjectVersion, allowing principals without historical-version permission to disclose known historical object content.

In Prowler prior to 5.37.0, the HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resource_tags, assembled by unroll_dict and parse_html_string, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned resource tag to store HTML or JavaScript that executes when another user opens the report.

An unauthenticated user may bypass authentication under specific cache conditions.

A party with write access to stored session data may affect JFrog Artifactory under specific conditions.

A bundle writer may create misleading release promotion information under specific conditions.

A repository publisher without delete permission may modify protected package content under specific conditions.

An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.

In Joomla extension SP Page Builder before 6.8.0, an unauthenticated attacker can create comments even when guest commenting is disabled by overriding the setting with user-supplied input.

In Joomla extension SP Page Builder before 6.8.0, an unauthenticated attacker can create arbitrary directories and files with a predefined name.

An authenticated user may write files outside the intended Artifactory work directory under specific conditions.

A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.

An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.

An authenticated user may view private Puppet module metadata without repository read access.

An authenticated user without repository read permission may access private NuGet metadata under specific conditions.

An unauthenticated user may access restricted repository information under specific conditions.

Credentials for a deleted user may remain valid for a short period under specific conditions.

regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. Version 0.11.5 fixes the issue.