CVE Vulnerability Catalog

Prior to version 2.0.0 of Pathling Server, the `$import-pnp` operation accepts a caller-supplied `exportUrl` and uses it as the remote FHIR Bulk Export endpoint without constraining it to a trusted source. When PNP credentials are configured, Pathling builds a credentialed bulk-export client targeting the caller-chosen host, downloads manifest-selected files, and then reclassifies those staged files as trusted local `file://` imports - bypassing the configured `allowableSources` allowlist that protects the ordinary `$import` operation. This is fixed in Pathling Server 2.0.0. As a workaround, disable the `$import-pnp` operation (`pathling.operations.importPnpEnabled=false`) or do not configure PNP credentials.

Prior to version 2.0.0 of Pathling Server, Pathling's typed CRUD/search/batch FHIR surface allows an authenticated caller with only coarse operation authorities to act on attacker-chosen resource families because those entrypoints do not consistently enforce the documented per-resource `read` and `write` authorities. The documented authorization model requires an operation authority (e.g. `pathling:search`) to be paired with the matching per-resource `read` or `write` authority (e.g. `pathling:read:Patient`). Delete and batch are documented to require write authority for all referenced resource types. However, typed search, update, and related handlers are annotated only with `@OperationAccess(...)` and act on the provider-selected resource type without checking the corresponding per-resource authority. This is fixed in Pathling Server 2.0.0.

Prior to version 2.0.0 of Pathling Server, Pathling's typed CRUD/search/batch FHIR surface allows an authenticated caller with only coarse operation authorities to act on attacker-chosen resource families because those entrypoints do not consistently enforce the documented per-resource `read` and `write` authorities. The documented authorization model requires an operation authority (e.g. `pathling:search`) to be paired with the matching per-resource `read` or `write` authority (e.g. `pathling:read:Patient`). Delete and batch are documented to require write authority for all referenced resource types. However, typed search, update, and related handlers are annotated only with `@OperationAccess(...)` and act on the provider-selected resource type without checking the corresponding per-resource authority. This is fixed in Pathling Server 2.0.0.

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an unrecovered panic and remotely deny service. A patch commit is available at 210f25f.

Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner() and parseElement(), raising a StackOverflowError. An attacker who can submit FHIR resources containing such narratives can thus crash a parsing or validation worker thread, affecting validator services and any application that parses attacker-supplied FHIR JSON or XML. This issue is fixed in version 6.9.11.

Prior to 6.9.11, the JSON utility parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth for arrays or objects. As a result, a small but deeply nested, syntactically valid FHIR JSON document can trigger unbounded readArray() or readObject() recursion, raising a StackOverflowError before structural validation runs. An attacker who can submit JSON resources for validation can thus crash the request thread, and services that do not isolate StackOverflowError safely may experience worker loss or process instability — a denial-of-service condition. This issue is fixed in version 6.9.11.

Element Call versions 0.5.17 through 0.19.3 report analytics data to a PostHog server when configured by a `posthog` key in config.json or by the `posthogApiHost` and `posthogApiKey` URL parameters. Several fields of this data (`$initial_person_info`, `$session_entry_url`, and `$current_url`) were found to contain the full URL of the user's visited page, including the fragment. Users of a standalone Element Call SPA instance such as https://call.element.io may have reported full URLs of certain calls, including encryption passwords, to the configured PostHog server.

Prior to version 2.0.0 of Pathling Server, Pathling's `/$result` endpoint allows a caller who can obtain any valid async export job ID to supply `file` parameter values containing path traversal sequences. The handler verifies only the supplied `job` and never normalises or confines the requested `file` path to that job's `jobs/<jobId>` directory before opening it as a filesystem resource. Because async export scratch space lives under the same warehouse database root as persisted resource tables, an attacker can use their own export job to read other files from the warehouse. This is fixed in Pathling Server 2.0.0. As an interim mitigation, disable the async export operations (`pathling.operations.exportEnabled`, `patientExportEnabled`, `groupExportEnabled`, `bulkSubmitEnabled`) or enable authentication and restrict export capability to trusted callers.

Pathling Server before version 2.0.0 allows an authorized submitter to supply an `oauthMetadataUrl` parameter without validation against the allowed sources list. The bulk-submit OAuth flow then trusts metadata and the returned token endpoint from the caller-chosen location, building outbound OAuth client authentication from stored credentials.

Pathling Server before version 2.0.0 has a path traversal vulnerability in the `/$result` endpoint. A caller who can obtain a valid async export job ID can supply `file` parameter values with path traversal sequences, allowing reading files outside the job's directory, including warehouse data.

Consul Community Edition and Consul Enterprise versions 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplete connections.

Ruby JSON versions 2.20.0 through 2.21.2 have a heap-use-after-free vulnerability in the native C extension. After consuming the input buffer of JSON::ResumableParser, state pointers remain pointing to released storage, and when partial_value reconstructs an incomplete object with duplicate keys, the duplicate-key warning path dereferences stale pointers, potentially terminating the Ruby process.

NexTor IP Changer before version 2.0.0 executes privileged system commands using `sudo` and `shell=True` directly inside application logic. In environments where passwordless sudo (NOPASSWD) is enabled, privileged commands may execute silently without explicit user confirmation.

NexTor IP Changer before version 2.0.0 has a command execution vulnerability due to unsafe use of `shell=True` with commands that rely on executable resolution through the PATH environment variable. An attacker controlling the execution environment can place malicious executables earlier in the PATH, resulting in execution of attacker-controlled code.

SourceCodester Simple Doctors Appointment System 1.0 has a SQL injection vulnerability in the file /admin/ajax.php?action=delete_appointment. Manipulation of the argument ID results in SQL injection, which can be launched remotely.

Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, token validation is skipped, allowing an unauthenticated remote attacker to trigger the operator's already-configured scheduled jobs.

Injection of false emergency or status messages over CPDLC may lead to misallocation of resources, operational confusion, and improper response actions by flight crews, traffic controllers, and ground operations. This type of attack can be carried out remotely over radio frequency.

Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages leading to unexpected or misleading clearances and potential pilot confusion. This type of attack can be carried out remotely over radio frequency.

In sol commit 373d848 (2024-12-12), the broker does not fully release resources when handling malformed or duplicate CONNECT packets. When clients send invalid CONNECT packets, the server may silently drop the connection or send a CONNACK but fail to close the session or deallocate internal resources. This allows an attacker to create numerous half-open connections that consume memory and file descriptors indefinitely, potentially triggering the Linux OOM killer and causing a denial of service.

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website, it is possible to escalate to RCE, but requires social engineering and explicit interaction by the victim. This issue affects all versions of WordPress; version 7.0.3 has been released with a fix, backported to all branches back to 4.7.