CVE Vulnerability Catalog

Electron (before versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3) applies some window options supplied by web content in the window.open() features string to the new BrowserWindow without an allowlist. Untrusted content could set window options it should not control, including options that cause the main process to access attacker-chosen file or network paths, when untrusted content can call window.open() and the app does not override child window options via setWindowOpenHandler or overrideBrowserWindowOptions.

A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to cause a denial of service (DoS) condition on an affected device. This is due to insufficient error handling in the web-based management interface. An attacker could exploit this by authenticating with a malformed certificate, potentially causing the device to reload.

A vulnerability in the web-based management interface of Cisco IOS XE Software allows an authenticated remote attacker with low privileges to perform a DoS attack. The issue is due to insufficient input validation, and exploitation can make the interface unresponsive.

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager allows an authenticated remote attacker with low privileges to view sensitive information in clear text. The issue is due to insufficient access control for certain template types, potentially exposing authentication credentials.

A vulnerability in the logging subsystem of Cisco RoomOS could allow an authenticated, local attacker with low privileges to access sensitive information. This is due to logging of sensitive data, and exploitation involves enabling a specific logging level and collecting system logs. Successful exploitation could reveal user login credentials.

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with Admin privileges to execute arbitrary commands on the underlying OS and elevate privileges to root. This is due to improper input validation, and exploitation involves entering crafted inputs. Successful exploitation allows command execution as root.

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user. This is due to insufficient input validation, and exploitation involves persuading a user to click a crafted link. Successful exploitation could allow arbitrary script execution in the user's browser or access to sensitive browser-based information.

A vulnerability in the network driver of Cisco Terminal Service (TS) Agent could allow an authenticated, remote attacker to bypass firewall rules associated with their account. This is due to incorrect mapping of network connections to user accounts. An attacker with at least user-level credentials can send crafted network traffic to inherit firewall rules of another user.

A vulnerability in imranrisal-dev Student-Management-System allows unrestricted file upload via the storeProfileImage function in student_profile_pic.php. An attacker can remotely manipulate the choose_file argument to upload arbitrary files. The exploit has been publicly disclosed and may be utilized.

A vulnerability in Electron prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0 occurs when a custom protocol handler returns a ProtocolResponse with a url and no session, causing the request to go through defaultSession instead of the session that handled the protocol. This can lead to cached responses being reused across isolated session partitions. Apps using ProtocolResponse.url, omitting ProtocolResponse.session, and relying on separate sessions are affected.

A vulnerability in Electron prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3 occurs when following HTTP redirects, net.fetch() and net.request() did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed. Apps are only affected if they make net requests to attacker-influenced URLs with redirects followed and expose the response body.

A vulnerability in Electron prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1 occurs because shell.openPath() did not reject paths containing embedded null bytes. Apps that perform string-only validation of file paths, such as checking the file extension, before passing them to shell.openPath() could be bypassed, allowing an attacker-controlled path to open a different file than the one that passed validation. Apps are only affected if they pass paths derived from untrusted input and rely on string-based validation without a filesystem check.

A vulnerability in Electron prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3 occurs because extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session could navigate, script, and read from windows belonging to a different session. Apps are only affected if they load Chrome extensions via session.loadExtension and rely on separate sessions to isolate that extension from other content.

In Electron prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, serial-port and media permission checks made from an iframe passed the top-level frame origin to session.setPermissionCheckHandler instead of the requesting iframe origin. Origin-based handler logic could grant a cross-origin iframe device access intended only for the top-level origin.

In Electron prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be bypassed by a local process. Apps that enable fuse-based hardening restricting ELECTRON_RUN_AS_NODE and NODE_OPTIONS to same-signed parents rely on this check, and a local attacker could bypass it and run code inside the signed app, inheriting its TCC permissions and keychain access.

Ghost from 4.9.0 until 6.54.1 had an input validation issue that allowed any staff user to create a post with content in feature_image_caption that could be used to hijack another staff user's Ghost Admin session, resulting in privilege escalation. This issue is fixed in 6.54.1.

Ghost from 6.26.0 until 6.54.1 had a validation issue that allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned. This vulnerability is fixed in 6.54.1.

ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML and JavaScript by supplying unsanitized values in the start_date and end_date GET parameters, which are echoed unescaped into HTML attribute values. Attackers can craft a malicious URL that, when followed by an authenticated victim with edit_settings permissions, executes injected scripts in the application origin to steal session cookies or perform unauthorized actions including user management, file management, and application settings changes.

Apache Answer through version 2.0.1 has an improper authorization vulnerability: any authenticated user can reject arbitrary pending edit-revisions without review permission due to a missing authorization check on the reject operation.

A flaw was found in openshift/oauth-proxy. On paths configured to bypass authentication (skip-auth-regex), the proxy forwards client-supplied identity headers (X-Forwarded-User, X-Forwarded-Email, X-Forwarded-Access-Token) to the upstream application without stripping them. An unauthenticated attacker can inject forged identity headers on whitelisted paths.