ArcadeDB versions prior to 26.10.2 have an improper authorization vulnerability where revoked users can maintain access through existing Postgres, Bolt, MongoDB, or Redis protocol connections. This occurs because the system does not properly expire sessions, allowing attackers with an open connection to continue reading and writing data even after their permissions are revoked, deleted, or passwords are changed.
ArcadeDB versions from 21.12.1 up to but not including 26.10.2 have an authorization bypass vulnerability. This flaw allows users with only readRecord privileges to replace the shared GraphQL schema via the read-only query endpoint. By sending a GraphQL type definition with a crafted @sql directive to the /api/v1/query/{database} endpoint, attackers can alter query results returned to other users, including administrators. The vulnerability is fixed in version 26.10.2.
ArcadeDB versions from 26.8.1 up to but not including 26.10.2 contain a server-side request forgery (SSRF) vulnerability. Authenticated users with the updateDatabaseSettings permission can disable the LOAD CSV IP block list by altering the database setting arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string. This allows them to issue LOAD CSV requests that can access cloud metadata and internal loopback or private services. The vulnerability is fixed in version 26.10.2.
Traefik versions from 3.2.0 up to but not including 3.7.15 contain a data race vulnerability in the experimental FastProxy feature. This flaw allows unauthenticated attackers to crash the Traefik process by abusing HTTP/1 protocol upgrades, such as repeatedly opening and aborting upgraded connections like WebSocket. The unsynchronized access to shared bufio.Reader leads to a panic that terminates the service.
Traefik versions 3.7.11 through 3.7.14 contain an authorization bypass vulnerability in the Kubernetes Ingress NGINX provider. This flaw allows users with permission to create Ingress resources to bypass cross-namespace authorization checks on the auth-tls-secret annotation by reusing a cached client authentication TLS option. As a result, such users can reference a CA secret from another namespace already used by another Ingress, enforcing it on their own routes and determining the secret's existence without accessing its contents. The issue is fixed in version 3.7.15.
Traefik versions from 3.7.0-ea.1 up to but not including 3.7.15 have an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider. This flaw causes mTLS configured via the auth-tls-secret annotation to be silently disabled when another Ingress on the same host declares a path without matching auth-tls settings. As a result, Traefik falls back to default TLS options, allowing unauthenticated attackers to access backends that require client certificates.
Parse Server versions from 9.7.0 up to but not including 9.10.5-alpha.10 contain an authorization flaw involving the handling of _Installation updates. This flaw allows an attacker who knows another installation's object ID to trigger processing of protected fields for that installation when the protectedFieldsTriggerExempt feature is enabled, potentially bypassing intended authorization controls.
Parse Server versions from 9.7.0 up to but not including 9.10.5-alpha.7 have an information disclosure vulnerability. This flaw allows clients with create or update permissions to read protected field values written by beforeSave triggers when the protectedFieldsSaveResponseExempt setting is false. The vulnerability is fixed in version 9.10.5-alpha.7.
Parse Server versions before 8.6.108 and from 9.0.0 up to but not including 9.10.5-alpha.9 contain a prototype pollution vulnerability. This flaw allows clients with class write access to send specially crafted keys using dot notation or ACL entry names that match built-in object members, leading to corruption of built-in functions. This corruption causes all requests to fail until the server is restarted.
Multiple vulnerabilities have been addressed in Juniper Networks Session Smart Router and Session Smart Conductor products. The specific vulnerabilities include a range of common weakness enumerations such as buffer overflows, path traversal, and improper access control. No detailed impact or exploitation information is provided.
CallBackery versions before 0.62.0 for Perl use a cryptographically weak pseudo-random number generator (PRNG) to generate the signing secret for session cookies. The secret is derived from two calls to the built-in rand() function, which is seeded with only 32 bits, resulting in a maximum of 2^32 possible secret values. An attacker who obtains a single signed session cookie can perform an offline brute-force attack to recover the secret and then forge valid session cookies for any user, including administrators. This vulnerability is fixed in version 0.62.0.
CallBackery versions prior to 0.62.0 for Perl have an insufficient session timeout vulnerability. Session cookies sent via the X-Session-Cookie header are accepted regardless of age, allowing indefinite authentication if the cookie is leaked. The cookieConf() function only enforces a 300-second timeout on cookies sent via the xsc query parameter, not the header. This flaw can lead to unauthorized persistent access if session cookies are exposed through logs, Referer headers, or browser history.
CallBackery versions prior to 0.62.0 for Perl create a temporary configuration database dump in /tmp with insecure permissions. The dump file is world-readable and not removed after creation, exposing sensitive data including password hashes. A local user can exploit this by reading the dump or redirecting it via a symlink to a file of their choosing.
CallBackery versions prior to 0.62.0 use an insecure method to encrypt configuration backups by deriving the AES key directly from a padded password without salt or key derivation. This allows an attacker who obtains a backup to perform fast offline password guessing at raw AES speed, potentially recovering all credentials stored in the backup.
CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup.
restoreConfigBlob() feeds the database dump in a backup to the sqlite3 command-line shell. The shell runs lines starting with a dot as its own commands, so .shell or .system in the dump runs an OS command and .load loads native code.
Anyone who can supply a backup to be restored can run arbitrary commands as the application user.
CallBackery versions before 0.62.0 for Perl contain a vulnerability that allows denial of service via inefficient regular expression complexity. The issue arises from unquoted interpolation of the request path as a regular expression in the before_dispatch hook, which processes PATH_INFO from client requests under CGI, FastCGI, and PSGI environments. An unauthenticated attacker can send a crafted request with a backreference in the path that causes exponential backtracking, tying up server worker processes for extended periods.
CallBackery versions prior to 0.62.0 for Perl contain a log injection vulnerability due to improper output neutralization of control characters in login names. The login RPC method does not require authentication, allowing an attacker to inject forged log entries by including newline characters in the login name. This can result in misleading log records, such as fake successful administrator logins from arbitrary IP addresses.
CallBackery versions before 0.62.0 for Perl contain a permissive regular expression vulnerability in the createRxValidator function. The function is intended to anchor patterns strictly but fails to group alternations properly, allowing unintended values to pass validation. This flaw permits authenticated users to submit values that should be rejected, potentially leading to unsafe data being written into generated configuration files.
CallBackery versions prior to 0.62.0 for Perl improperly expose sensitive information through the getUserConfig function. Non-administrative users can access their own password hash and administrator-only notes, which should be restricted. This flaw allows attackers with a session token to retrieve password hashes and potentially crack them offline.
CallBackery versions prior to 0.62.0 for Perl use unsalted HMAC-SHA1 hashes without a key to store user passwords. This hashing approach lacks a salt and computational work factor, making password hashes vulnerable to fast offline guessing attacks if the user table is obtained. The vulnerability is fixed in version 0.62.0.