CVE Vulnerability Catalog

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days after account deletion.

Axios before version 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.

FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 extension-unit parser that fails to validate descriptor length before accessing the GUID field. A local attacker with a malicious USB video camera can trigger a heap read beyond allocated bounds during camera stream setup, causing denial of service.

better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature. An attacker can supply a forged _multi-* cookie to trigger deletion of arbitrary session tokens.

The Event Tickets and Registration WordPress plugin before version 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with contributor-level access and above to overwrite the seating layout, ticket inventory, and attendee seat assignments of events they do not own.

The Booking for Appointments and Events Calendar WordPress plugin before version 2.4.4 does not restrict which fields can be written during customer import. A user with the Amelia Manager role can modify arbitrary columns of any stored user record by supplying them in the import request.

The Fluent Support WordPress plugin before version 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer. A restricted support agent can change the assigned customer of any ticket in the system, including tickets outside their granted scope.

The Brizy WordPress plugin before version 2.8.18 does not properly verify authorization on a request handler before returning post content. Users with the Contributor role or higher can read the content of arbitrary posts, including other users' private, pending, and draft posts.

The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token.

The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block.

In the sigstore-go library prior to version 1.2.1, a bundle signing timestamp is not checked against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate. This allows an attacker holding expired key material to sign accepted bundles.

Contao CMS versions 5.7.0 through 5.7.6 contain a cross-job authorization bypass vulnerability. An authenticated backend user can read attachments from other jobs by manipulating the attachment identifier with '../' sequences.

Contao CMS versions 5.3.35 through 5.3.47 and 5.7.0-RC1 through 5.7.8 contain an SSRF vulnerability in the Feed Reader module. A backend user with module-edit permissions can make the server request internal network services, loopback addresses, or cloud metadata endpoints.

Contao CMS versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6 contain a credential leakage vulnerability via the crawler. The crawler improperly cleans authentication options, potentially sending credentials to external hosts.

Ghost CLI before version 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header in a misconfigured Nginx.

HCL iControl was affected by Improper Error Handling vulnerabilities, involving out of memory, null pointer exceptions, system call failure, database unavailable, network timeout, and hundreds of other common conditions that can cause errors.

HCL iControl was affected by Auto complete Enabled vulnerabilities, exposing sensitive information such as valid usernames, email addresses used for login, and account identifiers. If accessed from shared environments, attackers may enumerate valid usernames through browser suggestions.

HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages, displaying raw server/API error messages to users instead of generic ones, exposing internal endpoint names, request parameters, error codes, and authentication status.

Improper Neutralization of CRLF Sequences in ufirstgroup ymlr (Elixir.Ymlr module) allows attackers to inject arbitrary content into generated YAML documents through comments. Ymlr.document!/2 interpolates comments without validation, allowing injection of newlines and fake keys. Affects versions from 0.0.1 before 5.1.6.

In the SAML protocol implementation of Keycloak, when a client is configured with a wildcard redirect URL, an attacker can craft a request with malicious parameters. After user authentication, Keycloak appends its legitimate response to the attacker's parameters, potentially causing the service provider to process the attacker's data instead of real login information, leading to user login to the wrong account.