PipesHub versions before 0.10.0 have a server-side request forgery (SSRF) vulnerability in the ImageParser._fetch_single_url function. This flaw allows attackers to cause the indexing service to fetch internal network addresses by embedding malicious image URLs in documents. Attackers can exploit this by supplying Markdown or HTML content through uploads, synced mailboxes, or web connectors, potentially accessing loopback, private network, or cloud metadata endpoints. The fetched image responses are then embedded into the indexed content, which could lead to information disclosure.
abp-next-admin versions 10.4.0 through 10.7.0 have a cross-tenant authorization bypass vulnerability in the BlobManagement download-by-name endpoint. This flaw allows authenticated users to access files belonging to other tenants by supplying a victim tenantId in the request path, causing the system to switch tenant context improperly and return blobs stored by that tenant.
xiaozhi-esp32-server versions up to 0.9.8 have an authentication bypass vulnerability in the WebSocketServer._handle_auth function. This flaw allows remote attackers to bypass Bearer HMAC token verification by spoofing the Device-ID header with an allowlisted MAC-address-shaped identifier. Exploitation enables opening an authenticated WebSocket session, issuing voice-assistant commands, exchanging audio, and accessing the conversation context of the spoofed device.
Bastille versions through 1.4.4 have a symlink following vulnerability in the cp.sh, rcp.sh, and jcp.sh subcommands. This flaw allows jailed users to escape their jail isolation by planting symbolic links that cause administrator-run copy operations to overwrite or read host files with root privileges.
WPGraphQL versions prior to 2.24.1 have a missing authorization vulnerability in the createComment mutation. This flaw allows unauthenticated attackers to add comments to non-public posts, including drafts, private, trashed, or password-protected posts. Exploitation can lead to leaking hidden post titles via moderator notifications, enumerating post IDs, and manipulating comment metadata such as backdating or marking comments as pingbacks.
WPGraphQL Smart Cache versions prior to 2.3.3 have a vulnerability that allows unauthenticated attackers to cause uncontrolled resource consumption. Attackers can persist unlimited query documents via the Automatic Persisted Query handler, leading to unbounded growth of the wp_posts table and degraded database performance.
WPGraphQL versions before 2.24.2 have an information disclosure vulnerability that allows unauthenticated attackers to determine the existence of certain objects. By sending requests to specific mutations such as deleteMediaItem, updateMediaItem, deleteComment, and updateComment, attackers can infer the presence of hidden draft, private, trashed posts, custom post types, and unapproved comments based on distinct error responses.
A stored cross-site scripting (XSS) vulnerability exists in The Events Calendar plugin by Liquid Web / StellarWP, affecting versions up to 6.18.2. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers with low privileges to execute scripts in the context of other users. The vulnerability has a CVSS score of 6.5, indicating a medium severity impact.
InternLM LMDeploy versions 0.9.0 through 0.18.0 have a critical unauthenticated remote code execution vulnerability. Attackers can send specially crafted pickled data to the /update_weights endpoint, which is deserialized without validation, allowing execution of arbitrary OS commands as the api_server process.
A Cross-Site Scripting (XSS) vulnerability exists in Crocoblock JetFormBuilder up to version 3.6.7.1 due to improper neutralization of script-related HTML tags. This allows an attacker to inject code into web pages generated by the affected software. The vulnerability has a medium severity rating with a CVSS score of 5.3.
SonicJS versions through 3.0.0 have a missing authorization vulnerability in certain API write routes. Authenticated users with author or editor roles can bypass document access controls and administrator restrictions to create, modify, publish, or soft-delete documents belonging to other users. This occurs because the API only checks coarse role labels rather than fine-grained permissions.
SerpBear versions prior to 3.1.1 have a missing authentication vulnerability in the pages/api/notify.ts endpoint. This flaw allows remote unauthenticated attackers to send repeated POST requests to /api/notify without verification, potentially exhausting SMTP rate limits, triggering abuse flags from email providers, and flooding notification recipients with emails.
A vulnerability in the GraphQL endpoint of traggo server version 0.8.3 allows attackers to cause a Denial of Service (DoS) by sending a crafted POST request to the endpoint.
The Tenda W18E router's web management server has an OS command injection vulnerability in its "diagnose" packet-capture feature. This flaw arises from improper validation of JSON input fields, allowing an authenticated user to inject shell metacharacters into parameters that are executed with root privileges. Notably, the vulnerability can be exploited without authentication if the device is in a factory-reset state.
Scribus versions prior to 1.6.7 have an out-of-bounds memory access vulnerability in the importsvm plugin. This flaw occurs because the plugin does not verify that bitmap and transparency mask dimensions match when importing SVM files. An attacker can craft a malicious SVM file with mismatched mask dimensions to trigger heap reads and writes, potentially causing application crashes or arbitrary code execution with the privileges of the user running Scribus.
Scribus versions prior to 1.6.7 have a heap buffer overflow vulnerability in the PICT image loader and import plugin. This flaw arises from improper validation of the bytesPerLine value in PICT files, which can exceed the QImage scanline size. Exploiting this vulnerability can cause Scribus to crash and potentially allow code execution with the privileges of the user running the application.
Scribus versions prior to 1.6.7 have an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader. This flaw allows attackers to craft TIFF files with large tile dimensions that trigger a heap overflow when imported, potentially causing application crashes or arbitrary code execution.
RTIR extends RT's HTML scrubber to allow an internal link placeholder, which inadvertently permits any link containing this placeholder, including javascript: scheme links. This affects the entire RT instance once RTIR is installed, allowing anyone who can add HTML content to a ticket, including unauthenticated senders to the Incident Reports queue, to embed such links. When a user clicks these links, scripts run with that user's privileges within RT. The issue was fixed in RT versions 5.0.11 and 6.0.4.
Scribus versions before 1.6.7 have a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin. This occurs when unpacking 4-bit indexed pixel data from a crafted PICT file with inconsistent width and row data. Exploitation can cause application crashes or potentially allow code execution.
RTIR's ticket creation forms improperly render the subject of related tickets without HTML escaping when splitting a ticket or creating an incident from a report. This allows an attacker who can send an email report to inject script code in the ticket subject, which executes in the session of the incident handler who processes the ticket. The vulnerability was fixed in RTIR version 6.0.4; version 5.0 is not affected.