Threats tagged 'bitnami'

CVE-2026-72531 is an improper access control vulnerability in Joomla! CMS affecting versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2. It allows unauthorized users with high privileges to create custom fields for components they should not access via webservice endpoints. The vulnerability has a medium severity with a CVSS score of 5.1.

CVE-2026-71573 is a vulnerability in Joomla! CMS involving improper CORS origin validation in versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2. This flaw allows certain CORS requests to bypass origin checks due to improper implementation. The issue is classified as CWE-93, related to improper neutralization of CRLF sequences. The vulnerability has a CVSS 4.0 base score of 6.9, indicating high severity.

CVE-2026-71572 is a medium severity vulnerability in Joomla! CMS affecting versions 3.0.0 through 5.4.6 and 6.0.0 through 6.1.2. It involves improper neutralization of CRLF sequences leading to response header injection in download views. This flaw allows reflected file download or content-type confusion due to lack of output processing in multiple download views.

CVE-2026-73373 is a critical vulnerability in Joomla! CMS affecting versions 1.0.0 through 5.4.6, 6.0.0 through 6.1.2, 1.0.0 through 3.3.0, and 4.0.0 through 4.2.0. It involves unrestricted upload of SHTML files, which were not included in the default dangerous file list. On servers configured to execute SHTML files, this could lead to remote code execution.

CVE-2026-73371 is an improper access control vulnerability in Joomla! CMS affecting versions 4.0.0 through 5.4.6 and 6.0.0 through 6.1.2. It allows unauthorized users with high privileges to perform batch copy operations on items they should not be able to edit. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.1.

CVE-2026-73337 is a high-severity vulnerability in Joomla! CMS affecting versions 4.0.0 through 5.4.6 and 6.0.0 through 6.1.2. It involves an improper authentication flaw where insufficient state checks allow bypassing multi-factor authentication (MFA) protections. This vulnerability enables attackers to circumvent 2FA mechanisms, potentially gaining unauthorized access without completing the required authentication steps.

CVE-2026-72532 is an improper access control vulnerability in Joomla! CMS affecting versions 4.0.0 through 5.4.6 and 6.0.0 through 6.1.2. It allows unauthorized users to create categories via webservice endpoints due to insufficient access control checks.

CVE-2026-71574 is an improper access control vulnerability in Joomla! CMS affecting versions 4.0.0 through 5.4.6 and 6.0.0 through 6.1.2. It allows unauthorized users to perform mutation actions via webservice endpoints that should be restricted, due to inconsistent ACL checks compared to the backend UI.

CVE-2026-73336 is a medium severity cross-site scripting (XSS) vulnerability in Joomla! CMS affecting versions 5.1.0 through 5.4.6 and 6.0.0 through 6.1.2. The issue arises from improper escaping in schema.org markup outputs, allowing potential injection of malicious scripts during web page generation. This vulnerability does not require user interaction and has low complexity for exploitation but requires high privileges to exploit. No known exploits are reported in the wild. No official patch information is provided in the input data.

CVE-2026-15806 is a vulnerability in the Python Software Foundation's CPython implementation affecting the urllib.request module's HTTPPasswordMgr class and its subclasses. The flaw caused credentials registered for HTTPS URLs to be sent over HTTP requests to the same host, and vice versa, exposing sensitive information in cleartext if an attacker could redirect or downgrade connections from HTTPS to HTTP. The issue is fixed by scoping credential matching to URL schemes, preventing cross-scheme credential leakage. Users unable to upgrade immediately should avoid making plain HTTP requests to hosts with stored credentials.

CVE-2026-63639 is a high-severity use-after-free vulnerability in the valkey distributed key-value database. It affects the RESTORE command prior to versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1. The flaw arises when a malformed RDB stream payload assigns a single Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, leading to a use-after-free condition if one consumer is deleted while others still reference the shared NACK. This can potentially allow remote code execution. The issue is fixed in the specified patched versions.

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.

CVE-2026-17084 is a vulnerability in the Python stringprep module where it incorrectly processes characters from RFC 3454 tables B.2 and B.3 by using the latest Unicode codepoint attributes instead of those from Unicode 3.2.0. This causes mismatches when handling domain names with IDNA 2003 encoding, particularly for characters whose Unicode attributes have changed since Unicode 3.2.0. The issue affects multiple CPython versions prior to their respective fixed releases.

A missing authorization vulnerability in GitLab Enterprise Edition allowed authenticated users to bypass IP-based access restrictions and access limited merge request information from private projects. This issue affected multiple version ranges prior to fixed releases. The vulnerability has been remediated by GitLab with official patches available.

A missing authorization vulnerability in GitLab EE versions from 16.0 up to but not including 19.0.6, 19.1 up to 19.1.4, and 19.2 up to 19.2.2 could allow an authenticated user with developer-role permissions to view external status check configurations that should be restricted to higher-privileged roles. This issue affects a merge request API endpoint and has been remediated by GitLab.

GitLab Enterprise Edition versions 19.1.0 through 19.1.3 and 19.2.0 through 19.2.1 contain an authorization bypass vulnerability. This flaw could allow an authenticated user to have AI usage incorrectly attributed to another namespace due to improper authorization of identity information in requests. The issue has been remediated in versions 19.1.4 and 19.2.2.

GitLab Enterprise Edition versions 19.1.0 through 19.1.3 and 19.2.0 through 19.2.1 contain an incorrect authorization vulnerability in a GraphQL query. This flaw could allow an authenticated user to read policy configuration data belonging to namespaces they are not authorized to access. The issue has been remediated in versions 19.1.4 and 19.2.2. No known exploits are reported in the wild.

A missing authorization vulnerability in GitLab Enterprise Edition versions 19.1.0 through before 19.1.4 and 19.2.0 through before 19.2.2 could allow an authenticated user to modify project settings that should be restricted to higher-privileged roles. This issue arises from missing authorization checks on a project update endpoint. The vulnerability has been remediated in versions 19.1.4 and 19.2.2.

A cross-site scripting (XSS) vulnerability was identified in GitLab CE/EE affecting versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2. The issue arises from improper neutralization of user-controlled input rendered in table cell content by an analytics dashboard component. This vulnerability has been remediated in the specified fixed versions.

A cross-site scripting (XSS) vulnerability was identified in GitLab CE/EE affecting versions from 18.2 up to but not including 19.0.6, 19.1 up to but not including 19.1.4, and 19.2 up to but not including 19.2.2. The issue arises from improper neutralization of user-controlled input rendered in pagination controls within an analytics dashboard component. This vulnerability has been remediated in the specified fixed versions.