Search: 7.3.1.1

Parse Server versions from 9.7.0 up to but not including 9.10.5-alpha.7 contain an information disclosure vulnerability. This flaw allows clients with create or update permissions to read protected field values that are set by beforeSave triggers using dot notation keys when the protectedFieldsSaveResponseExempt setting is false. The vulnerability has a low severity score and does not affect integrity or availability.

Dell OpenManage Enterprise versions prior to 4.8.0 contain an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This flaw allows a low privileged attacker with remote access to potentially expose sensitive information. The vulnerability has a high severity rating with a CVSS score of 7.1. No specific patch information is provided in the input data.

pybars3 through 0.9.7 and pybars4 through 0.9.13 contain a code injection vulnerability in pybars/_compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to break out of string literals and execute Python in the application process.

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leading to crashes or heap memory disclosure.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

The joserfc library's decrypt_json() function for JWE General JSON Serialization accepts an unbounded recipients array, performing an RSA private-key decryption for each recipient without limit. This allows an unauthenticated attacker to cause CPU exhaustion (Denial of Service) by sending a single JWE with many recipients. The library caps other JWE structural elements but does not limit recipient count. The documented mitigation option verify_all_recipients=False does not reduce CPU usage, as all recipients are decrypted regardless. This vulnerability is fixed in joserfc version 1.7.5.

The @nx/maven and @nx/gradle plugins for Nx have an OS command injection vulnerability due to unsafe interpolation of plugin options from nx.json into shell commands. This allows execution of arbitrary commands when running nx commands that construct the project graph. The vulnerability affects specific versions of these plugins and has been fixed in versions 22.7.9 and 23.1.2. Users should upgrade both the nx package and the affected plugins to these versions or later to remediate the issue.

HuLa-Server versions up to 3.0.7 have an insecure direct object reference vulnerability in the FriendController.friendList endpoint. Authenticated users can bypass authorization checks by supplying a user ID (uid) parameter in GET requests to /user/friend/page, allowing them to view other users' friend lists without proper permission.

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying arbitrary feedId values. Attackers can send POST requests to /feed/del with another user's feedId to delete their moments along with associated media, comments, and likes.

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requests to /privacy with a target uid parameter to read and overwrite that user's UserPrivacy settings without ownership checks.

AFFLIB versions up to 3.7.22 have a heap out-of-bounds write vulnerability in the af_get_page() function. This occurs when crafted AFF images use mismatched page and sector sizes, allowing memory corruption and potential crashes of forensic tools.

Traefik versions from 3.2.0 up to but not including 3.7.15 contain a data race vulnerability in the experimental FastProxy feature. This flaw allows unauthenticated attackers to crash the Traefik process by abusing HTTP/1 protocol upgrades, such as repeatedly opening and aborting upgraded connections like WebSocket. The unsynchronized access to shared bufio.Reader leads to a panic that terminates the service.

Traefik versions 3.7.11 through 3.7.14 contain an authorization bypass vulnerability in the Kubernetes Ingress NGINX provider. This flaw allows users with permission to create Ingress resources to bypass cross-namespace authorization checks on the auth-tls-secret annotation by reusing a cached client authentication TLS option. As a result, such users can reference a CA secret from another namespace already used by another Ingress, enforcing it on their own routes and determining the secret's existence without accessing its contents. The issue is fixed in version 3.7.15.

Traefik versions from 3.7.0-ea.1 up to but not including 3.7.15 have an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider. This flaw causes mTLS configured via the auth-tls-secret annotation to be silently disabled when another Ingress on the same host declares a path without matching auth-tls settings. As a result, Traefik falls back to default TLS options, allowing unauthenticated attackers to access backends that require client certificates.

Forgejo versions through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 have a path traversal vulnerability in the restore-repo feature. This flaw allows attackers to read files outside the intended dump directory by supplying crafted asset paths containing '../' sequences. Specifically, attackers can manipulate the release.yml file's DownloadURL or PatchURL to import arbitrary files as release attachments during repository restoration.

OPNsense core versions before 26.7.8 have a configuration line injection vulnerability. Authenticated users with wireless-edit privileges can inject arbitrary directives by embedding carriage return and line feed characters in WPA fields such as wpa.identity, wpa.passphrase, or RADIUS shared secrets. This allows attackers to append unauthorized wpa_supplicant or hostapd directives that are loaded by root-run daemons.

OPNsense core versions prior to 26.7.8 have a log injection vulnerability that allows unauthenticated attackers to submit specially crafted WebGUI login usernames. This can cause victim IP addresses to be planted in the lockout_handler, resulting in the victim being blocked from SSH and WebGUI access and disruption of pf states.

Certain versions of CakePHP contain an email header injection vulnerability due to incomplete sanitization of header values in SmtpTransport and MailTransport. Attackers who can control custom email headers via Message::setHeaders() or Message::addHeaders() may inject bare carriage return (CR) or line feed (LF) characters, enabling injection of additional headers such as Bcc. This could allow redirection or alteration of outgoing emails.