CVE Vulnerability Catalog

Vulnerability in cal.diy up to version 6.2.0. Open redirect in the conferencing OAuth callback endpoint. Attackers can redirect users to arbitrary URLs via a malicious state parameter.

HyperDX before version 2.31.0 contains a server-side request forgery (SSRF) vulnerability. Authenticated team members can direct the server to make requests to arbitrary internal network destinations by supplying a caller-controlled URL to the webhook test endpoint. Attackers can bypass insufficient hostname blacklist validation in the webhook handler to enumerate internal services, interact with internal containers, or access cloud instance metadata services including provider metadata endpoints.

Joomla extension Hikashop versions below 6.5.2 are vulnerable to an open redirect. An attacker can redirect users to a malicious site.

The JMedia extension for Joomla! versions below 1.6.0 is vulnerable to server-side request forgery (SSRF). The remote URL download functionality can be abused to target internal/reserved addresses.

The Joomla extension Quix Page Builder Pro before version 6.2.1 discloses information by returning raw exceptions in AJAX handler responses. This vulnerability allows technical data leakage.

The Joomla extension Quix Page Builder Pro before version 6.2.1 contains an authenticated stored XSS vulnerability. Authenticated users can inject malicious code into id/class fields that are rendered for public users.

xrdp versions 0.10.6 and earlier contain a vulnerability in parsing client security data. An unauthenticated attacker can send a crafted RDP packet, causing out-of-bounds memory read.

Vulnerability in Flask-Security-Too version 5.8.0 in the OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account belonging to a different user. An attacker can use an authenticated but stale victim session to perform freshness-protected actions.

FreeScout prior to version 1.8.219 has a vulnerability in the open tracking endpoint GET /thread/read/{conversation_id}/{thread_id} allowing unauthenticated attackers to enumerate valid conversation and thread IDs and modify thread state without authentication.

RT (Request Tracker) versions 6.0.0 through 6.0.2 contain a stored XSS vulnerability. An authenticated user with appropriate permissions can inject JavaScript that executes when another user views the page.

RT (ticket tracking system) versions 6.0.0 through 6.0.2 contain a reflected XSS vulnerability. An attacker can trick an authenticated user into visiting a crafted URL, allowing arbitrary JavaScript execution in the victim's session.

Mettle SendPortal 3.0.1 and earlier contains a stored XSS vulnerability in the template management functionality. The application fails to properly sanitize user-supplied input in the content parameter of the /templates endpoint, allowing an attacker to persistently inject malicious JavaScript code.

In the Linux kernel, a bug in DualPI2 (net/sched) GSO segmentation accounting causes double counting in the parent queue. When QFQ is the parent, after all real packets are dequeued, the queue still has non-zero length, leading to a NULL pointer dereference.

A livelock and Hung Task panic were discovered in the Linux kernel's i2c-i801 driver. When i801_check_pre() fails (e.g., returning -EBUSY), the error path incorrectly clears hardware registers without owning the SMBus controller, corrupting the hardware state machine and causing endless error logs.

A vulnerability was found in the Linux kernel's BPF INODE_STORAGE maps when BPF LSM is not initialized at boot. An uninitialized inode security blob offset aliases the RCU callback pointer, causing a kernel panic when executing code from address 0x0.

In the Linux kernel, a vulnerability in the team driver (net/team) causes a NULL pointer dereference when a mode change clears the transmit function pointers while concurrent network traffic is being processed, leading to a kernel crash.

In the Linux kernel's XFS filesystem, a crafted log with a transaction header but no data regions causes a NULL pointer dereference during recovery, leading to a kernel crash.

Vulnerability in Network-AI (versions 5.0.0-5.12.1) in the ApprovalInbox component. The HTTP server lacks authentication and sets Access-Control-Allow-Origin: *, allowing anyone who can send an HTTP request (including websites in the operator's browser) to approve pending high-risk actions without human consent.

Vulnerability in Network-AI (versions before 5.12.2) in the file sandbox mechanism. Path checks rely on string prefix matching, allowing an agent to read files from sibling directories with similar names (e.g., /tmp/network-ai-sandbox_evil) outside the intended sandbox.

Vulnerability in Network-AI (versions before 5.12.2) in the environment backup function. The _collectBackupFiles() function follows symbolic links, allowing an attacker to place a symlink to an external directory and copy its contents into the backup archive.