HCL AION contains a vulnerability where browser autocomplete is enabled on sensitive login form fields. This allows browsers to store and suggest previously entered credentials. A malicious user with access to the same browser or system could retrieve these saved credentials, potentially leading to unintended security impacts under certain conditions. The vulnerability is classified as CWE-522 (Insufficiently Protected Credentials) and has a low severity score of 3.3. No specific affected versions or patches are currently documented.
HCL AION contains a vulnerability that exposes internal server file system paths in certain application responses. This exposure could aid attackers in understanding the application's structure, potentially enabling further attacks. The vulnerability has a low severity rating and does not directly impact integrity or availability.
Red Hat JBoss Enterprise Application Platform 8.1.9 includes multiple security fixes addressing vulnerabilities in components such as Netty and Apache CXF. The fixes cover issues like information disclosure via CORS header overwrite, denial of service via uncontrolled form parameters and many attachment headers, authentication bypass via crafted OIDC tokens, and XML External Entity (XXE) vulnerabilities via WSDL/XSD import parsing. These vulnerabilities could impact the confidentiality, availability, and authentication mechanisms of applications running on this platform.
A vulnerability exists in Johnson Controls EasyIO Neo IOManager and Tools Installer version 1.1.0.0 that allows inclusion of functionality from an untrusted control sphere, enabling malicious software updates. This flaw could be exploited by an attacker with limited privileges and user interaction, but requires physical access. The vulnerability has a high severity rating with a CVSS 4.0 score of 7.3. No patch or remediation information is currently available.
Jumis (formerly Tildes Jumis) creates a Microsoft SQL Server login named ##Tilde_JumisAdmin## with a password deterministically derived from the SQL Server name, which is publicly discoverable. This login is part of the sysadmin role, granting full administrative access to the SQL Server instance and all hosted accounting databases. The server also enables xp_cmdshell, allowing attackers with sysadmin access to execute operating system commands. This vulnerability allows any party able to reach the Jumis SQL Server to compute the admin password offline and gain full control without prior authentication.
Fluxbox versions through 1.3.7 have an infinite loop vulnerability in the Menu::updateMenu() function. This flaw allows attackers to cause the window manager to hang by supplying a crafted style with an oversized unbounded menu.titleHeight, resulting in a non-terminating column loop. The attack leads to sustained CPU usage and denial of service during startup.
Agenta versions prior to 0.122.5 have a server-side request forgery (SSRF) vulnerability. This flaw allows workspace members with workflow edit permissions to redirect workflow invocations by specifying arbitrary revision URLs. Exploiting this, attackers can capture secret-resolve Authorization tokens and access provider secrets from the vault API or reach internal and cloud metadata endpoints.
ChatWiki versions before 2.10.0 have an insecure direct object reference (IDOR) vulnerability. Authenticated users can exploit this flaw to modify fast commands belonging to other tenants by submitting arbitrary sequential IDs to the POST /manage/saveFastCommand endpoint. This allows attackers to overwrite command attributes such as title, type, content, and robot binding, potentially redirecting commands to attacker-controlled URLs and reassigning commands to their own tenant.
A security flaw exists in the Email Notification Handler component of nasa-gcn (gcn.nasa.gov) up to commit b299b562af665878964b981a459f0a9c04b11adf. The vulnerability involves improper authorization due to manipulation of the Recipient argument in the /user/email file processing. The flaw can be exploited remotely. Public exploit code is available. The product uses a rolling release model, so specific affected or fixed versions are not provided. A fix has been proposed but is pending acceptance.
A weakness in kubescape versions up to 4.0.15 affects the GetWriter function in the Output component, allowing manipulation of the outputFile argument that can lead to permission issues. The vulnerability requires local access and user interaction to exploit. Upgrading to version 4.0.16 addresses this issue.
Fluxbox versions up to 1.3.7 have an OS command injection vulnerability in the RootTheme::reconfigTheme() function. This flaw allows attackers to execute arbitrary commands by crafting style background values that include shell metacharacters. These crafted values are concatenated without proper escaping into an fbsetbg command executed via the shell when the style loads.
ChatWiki versions prior to 2.10.0 have an insecure direct object reference (IDOR) vulnerability in the SaveFormField and UpdateFormRequired functions. This flaw allows authenticated users to modify form fields belonging to other tenants by manipulating form_id and form_field id parameters. Such unauthorized modifications can alter field names, descriptions, types, and required flags, potentially disrupting the storage of submitted entries.
Charmbracelet wish versions before 2.0.5 have a path traversal vulnerability in the git middleware component. This flaw allows authenticated SSH users to bypass directory containment checks by using crafted repository paths with relative directory references. Exploitation enables reading or writing arbitrary repositories outside the intended root directory via git-upload-pack, git-upload-archive, or git-receive-pack.
Skyvern versions through 1.0.56 have a sandbox bypass vulnerability that allows authenticated users to execute arbitrary code on the server. This is achieved by reconstructing functions from raw bytecode using types.CodeType, enabling attackers to deploy scripts that evade the is_safe_script_code AST denylist and import restricted modules such as subprocess or socket. The vulnerability has a high severity with a CVSS score of 8.8.
Usermin versions up to 2.570 contain a cross-site scripting (XSS) vulnerability in the mailbox/detach.cgi component. This flaw allows remote attackers to execute arbitrary scripts by supplying a crafted type parameter that bypasses JavaScript filtering. Exploitation involves sending an HTML email attachment with script and tricking the user into clicking a specially crafted detach.cgi link, resulting in script execution within the victim's authenticated Usermin session.
Usermin versions up to 2.570 have a path traversal vulnerability in the mailbox/detachall.cgi script. This flaw allows remote unauthenticated attackers to write files outside the intended temporary directory by exploiting unsanitized attachment filenames containing '../' sequences. By sending specially crafted email attachments and triggering the download of all attachments, attackers can overwrite critical files such as ~/.forward, potentially enabling command execution on the affected system.
ABP Framework versions prior to 10.7.1 have an authentication bypass vulnerability. This flaw allows attackers who possess the external directory password for accounts that are deactivated, locked, or protected by two-factor authentication (2FA) to bypass account state and 2FA checks. By exploiting the vulnerability through a registered external login provider, attackers can obtain valid access tokens via the /connect/token password grant endpoint.
Usermin versions up to 2.570 have an OS command injection vulnerability in the Read Mail module. Authenticated users can exploit unsanitized IMAP folder names containing shell metacharacters to execute arbitrary commands as their system account. This bypasses webmail-only restrictions by leveraging folder deletion functionality.
Craft CMS versions 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contain a blind SQL injection vulnerability. This occurs because the getNext() and getPrev() methods expose sandboxed template functionality that improperly passes arbitrary criteria arrays to Craft::configure() without filtering out SQL-related properties like orderBy and where. Authenticated control panel users can exploit this by supplying crafted elementIds values to execute conditional SQL queries under the Craft database account.
A regression in the enforcement of FIPS algorithms in the Python hashlib module affects only Python version 3.14.10 when using OpenSSL in FIPS mode. Other Python versions are not impacted.