CVE Vulnerability Catalog

Vulnerability in SurrealDB before version 2.0.4. Field permissions are not enforced during SELECT, UPDATE, and DELETE operations. An authenticated user can access field values they lack permission for using techniques like SELECT VALUE, field aliasing, functions, WHERE clause, RETURN BEFORE, and SET.

SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions. Authorized clients can craft pre-parsed queries invoking nonexistent functions to trigger a panic that crashes the server.

SurrealDB before version 1.2.1 contains an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator characters. Authorized clients can submit malformed queries that trigger a panic and crash the server.

SurrealDB before 1.5.4 and 2.0.0-alpha.1 before 2.0.0-alpha.6 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. An attacker with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists.

SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authorized clients can execute malformed queries with empty string conversions to record, duration, or datetime types that cause a panic in error rendering, crashing the server.

SurrealDB before version 2.1.0 has a denial of service vulnerability in the sorting mechanism when using ORDER BY rand(). Authorized clients can execute queries with ORDER BY rand() to trigger a panic in the sorting function, crashing the server.

SurrealDB before version 2.1.0 contains a denial of service vulnerability in role conversion. A privileged user can define users with nonexistent roles, and signing in with such a user triggers an uncaught panic, crashing the server.

Vulnerability in SurrealDB before version 2.1.0 in the rand::time() function panics when unwrap is called on a None result from timestamp_opt. Authorized clients can repeatedly invoke rand::time() to trigger server panics and cause denial of service.

SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a table's permissions via OVERWRITE does not take effect, and the administrator may incorrectly believe the change was applied. As a result, a client authorized to run queries may continue to access data in that table that the updated (but unapplied) permissions were intended to restrict.

A path traversal vulnerability was found in halo-dev halo up to version 2.24.2 in the Download function of the Files Backup Endpoint component. The attack can be performed remotely and the exploit is publicly available.

A security vulnerability has been detected in Sipeed PicoClaw up to version 0.2.9, affecting the NewContextBuilder function in pkg/agent/context.go. The flaw allows inclusion of functionality from an untrusted control sphere, potentially leading to unauthorized actions. The attack requires local access, and the exploit has been publicly disclosed.

A security flaw in Sipeed PicoClaw up to version 0.2.9 allows authentication bypass via capture-replay attack in the LINE Webhook component. The vulnerability affects the webhook.ParseRequest function in pkg/channels/line/line.go. Remote exploitation is possible, and a public exploit increases the risk.

Sipeed PicoClaw up to version 0.2.9 has a time-of-check time-of-use (TOCTOU) vulnerability in the ExecTool.executeRun function. A local attacker can exploit this to compromise data integrity.

A cross-site request forgery (CSRF) vulnerability was found in Sipeed PicoClaw up to version 0.2.9 in an unknown function of the file web/backend/api/auth.go. The attack can be launched remotely and the exploit has been publicly disclosed.

A vulnerability was found in AstrBot up to version 4.25.5 in the _normalize_rw_path function of the fs.py file in the Filesystem Computer-Use Tool component. The flaw allows link following with local access. The exploit is public and the vendor did not respond.

A vulnerability in AstrBot up to version 4.25.5 affects the OpenApiRoute.chat_send function in open_api.py. Manipulating the Username argument in the API allows authentication bypass via spoofing. The attack can be launched remotely and exploit details are publicly available.

The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to 2.2.0. Missing nonce validation on the storeInfo function allows unauthenticated attackers to modify Zoho CRM integration settings via a forged request if they trick an admin into clicking a link.

A flaw in AstrBot up to version 4.25.5 affects the OpenApiRoute.get_chat_sessions function in astrbot/dashboard/routes/open_api.py. Manipulation of the Username argument in the session-listing endpoint leads to authorization bypass. The attack is remotely exploitable and a public exploit exists.

A vulnerability in Microsoft Edge (Chromium-based) allows authentication bypass via an alternate path or channel. An unauthorized attacker can perform tampering over a network.

@hapi/inert versions 4.0.0 to 7.1.0 have a vulnerability due to improper path comparison in the confine mechanism, allowing an unauthenticated remote attacker to read files from sibling directories, e.g., via /..%2fstatic-secret/secret.txt.