CVE Vulnerability Catalog

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 are vulnerable to remote code execution due to improper handling of DRDA handshake before authentication.

A vulnerability in IBM Db2 allows an authenticated user to read sensitive information from monitoring and event tables. It affects versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 on Linux, UNIX, and Windows.

Orkes Conductor versions 3.21.21 through 3.30.2 contain an unauthenticated remote code execution vulnerability. Attackers can submit malicious workflow definitions with JavaScript or Python expressions to the API before authentication, allowing arbitrary OS command execution.

The Webmention plugin for WordPress up to version 5.8.0 is vulnerable to Stored Cross-Site Scripting via parser-derived 'avatar' and 'url' author metadata. This is due to insufficient input sanitization and output escaping on user-supplied MF2 author properties processed by the unauthenticated webmention REST endpoint and rendered directly into HTML 'value' attributes by the edit-comment-form template.

The Zephyr Bluetooth controller ISO Adaptation Layer (isoal.c) fails to validate the length of a framed ISO PDU start segment. An attacker over Bluetooth can send a crafted packet causing an integer underflow and out-of-bounds read.

The HP Fan Control App might allow local escalation of privileges. The vulnerability stems from improper access control in HP's fan management software.

A broken access control vulnerability in JeecgBoot through version 3.9.2 allows authenticated low-privilege users to perform full CRUD operations on OpenAPI credentials via OpenApiAuthController and OpenApiPermissionController endpoints lacking Shiro authorization annotations. The list endpoint exposes secret keys in plaintext, enabling credential theft and unauthorized API invocation.

Dolibarr up to version 23.0.3 (fixed in commit 14db36e) contains a SQL injection vulnerability. Authenticated API users can exfiltrate arbitrary database contents by supplying malicious values to the sqlfilters parameter in the setup dictionary and multicurrencies REST API endpoints.

JimuReport up to version 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication. The @JimuNoLoginRequired annotation causes all access controls to be skipped, and the export service streams the report for any supplied ID without verifying the auto-export configuration flag. An unauthenticated attacker can enumerate Snowflake report identifiers and export the full contents of any report, including data from SQL queries and credentials embedded in data sources.

A vulnerability in CVAT before version 2.69.0 in the QualityReportViewSet.get_queryset allows authenticated attackers to enumerate quality report identifiers belonging to other organizations. The missing check_object_permissions call on the parent_id parameter in the quality reports API endpoint enables distinguishing existing and non-existing reports via HTTP 500 vs 404 responses.

SeaweedFS before version 4.34 has a path traversal vulnerability in the S3 gateway DeleteMultipleObjectsHandler. An authenticated S3 principal with write access to a single bucket can delete arbitrary objects in other tenants' buckets by supplying object keys containing ../ sequences in the DeleteObjects XML request body.

A vulnerability in SeaweedFS before version 4.30 reflects the callback query parameter without validation in JSON responses served as application/javascript. Missing X-Content-Type-Options: nosniff header and CORS allow-list allows an attacker to load responses from any JSON endpoint (including unauthenticated ones) via a <script> tag from a third-party web page.

A vulnerability in Woodpecker before version 3.15.0 allows bypassing the ApprovalAllowedUsers list by manipulating the pipeline.Author field. For GitLab integration, the commit author is taken from webhook data which can be attacker-controlled. A user opening a merge request from a fork can set the commit author name to match an entry in ApprovalAllowedUsers, causing the pipeline to run without required approval.

Woodpecker before version 3.15.0 exposes the /api/orgs/lookup/*org_full_name endpoint without authentication middleware, and the handler triggers a NULL pointer dereference for unauthenticated requests. Each request causes a panic that is recovered by gin middleware but writes a multi-line stack trace to the error log.

In RuoYi-Vue-Plus up to version 5.6.2 (fixed in commit 88d03d9), workflow task management endpoints in FlwTaskController lack any permission checks. Any authenticated user, regardless of role, can reassign tasks, urge tasks, and list all pending and finished tasks.

A vulnerability in Hermes WebUI before version 0.51.521 allows bypassing profile isolation. When importing a session, the workspace of the active named profile is validated, but the Session object is created without setting its profile, resulting in the session being persisted with a null profile. A null profile is treated as the default profile, enabling a user on the default profile to export the session transcript and read files from the named profile's workspace.

A path traversal vulnerability in Vibe-Trading before version 0.1.10 allows attackers to write files outside the intended memory root directory by supplying a malicious memory_type value containing path traversal sequences. Attackers can manipulate the memory_type parameter in the persistent memory store to write arbitrary Markdown files to unintended filesystem locations.

A vulnerability in Ocelot through version 24.1.0 (fixed in commit f156fd4) allows bypassing IP-based access controls by sending WebSocket upgrade requests. The WebSocket upgrade pipeline branch configured via MapWhen in OcelotPipelineExtensions.cs omits SecurityMiddleware, causing requests from blocked IP addresses to be proxied to downstream services without enforcing the allow/block list.

A vulnerability in Vibe-Trading before version 0.1.10 allows reading and overwriting run.json files outside the runs directory. An attacker can exploit a crafted run identifier supplied via MCP swarm tools, leading to data confidentiality and integrity breaches.

A path traversal vulnerability in Vibe-Trading before version 0.1.10 allows an attacker to load a controlled JSON file as an authoritative trading mandate by manipulating the proposal identifier. Combined with the file upload endpoint, an admitted caller can fully control the committed mandate, bypassing ceilings validation.