CVE Vulnerability Catalog

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution.

Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resolve the hostname again. A builder could use DNS rebinding to make packages/server/src/integrations/rest.ts connect to an internal address after a public address passed validation, with full response access and arbitrary REST methods. The fix adds createPinnedLookup support to the undici dispatcher and passes the validated address to custom fetch implementations. This issue is fixed in version 3.40.0.

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double slashes, or percent-encoded sequences to pass role-based restriction checks while the filesystem resolves the request to the protected file, enabling unauthorized file download without credentials.

Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions (DSOP) values to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons m_modifierTranslationTable, after which ServerProxy::translateKey() or ServerProxy::translateModifierMask() indexes the seven-row s_translationTable or s_masks arrays out of bounds, disclosing four bytes at an attacker-selected relative offset or crashing the connected client; an odd option count also causes an out-of-bounds OptionsList read. This issue is fixed in continuous build 1.26.0.299.

ERPNext prior to versions 15.116.0 and 16.23.0 contains a vulnerability where an unvalidated doctype filter is interpolated into raw SQL in get_sales_details and get_last_sales_amt, allowing an authenticated user to extract sensitive information and manipulate database queries.

WordPress is vulnerable to remote code execution via malicious Postscript file upload by an Author level user or higher, when Imagick and Ghostscript are in use on the server.

Budibase prior to version 3.39.19 has a vulnerability in the PostgreSQL datasource connector where the user-controlled schema field is interpolated into a SET search_path statement without escaping embedded double quotes, allowing an authenticated administrator to execute arbitrary SQL.

Deskflow from version 1.17.0 until continuous build 1.26.0.296 has a vulnerability where a malicious Deskflow server can send an odd-length DSOP vector, causing an out-of-bounds read and crashing the connected client.

Budibase prior to version 3.41.3 has a vulnerability in the POST /api/attachments/:datasourceId/url endpoint, where an authenticated published-app user with the BASIC role can supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentials.

vm2 prior to version 3.11.6 has a vulnerability where the bufferAllocLimit enforcement does not cover Buffer.concat(list, totalLength) or Buffer.from(arrayLike) with an attacker-controlled length, allowing sandbox code to perform large synchronous host external-memory allocations that bypass the configured cap and can exhaust the host process.

Budibase prior to version 3.41.3 has a vulnerability in automation steps (outgoingWebhook, zapier, n8n, slack, discord) where they use node-fetch on user-provided URLs without the BLACKLIST_IPS enforcement, allowing an authenticated user to make server-side requests to cloud metadata and internal services.

FreeCAD prior to version 1.1.2 has a vulnerability in PropertyPythonObject::Restore() where the attacker-controlled module attribute from serialized PropertyPythonObject XML is passed directly to PyImport_ImportModule() while restoring a crafted FCStd document, executing module-level Python code. The legacy pickle branch also imports an attacker-controlled module and invokes its class constructor.

FreeCAD from version 0.19 until 1.1.1 has a vulnerability in the BIM Workbench where an eval() call is made on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrary Python code executes.

FreeCAD from version 0.19 until 1.1.1 has a vulnerability in the BIM Project Manager Load Template flow where attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis are passed directly to eval(), allowing arbitrary Python code execution when a user loads a malicious BIM project template.

Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability is fixed in Packer 1.16.0.

A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/get_barcode_data.php. This manipulation of the argument barcode causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.

ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set() and apos.util.get(), allowing an authenticated editor to overwrite the shared Object.prototype.toString function's call property and cause a persistent process-wide denial of service until restart.

A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve `system:masters` access, granting them full control over the cluster.

An issue in ACME mini_httpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request header parser in the handle_request() function

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint injects the STIRLING-PDF-BACKEND-API-USER API key into pipeline subrequests, allowing an authenticated ROLE_USER to retrieve the key through /api/v1/user/get-api-key, impersonate the internal service account, bypass normal rate limits, and access internal endpoints including /api/v1/info/requests/all and /api/v1/info/load/all. This issue is fixed in version 2.9.0.