Control Web Panel (CWP) versions before 1.16 contain a critical path traversal vulnerability in the services/users/index.php file. This flaw allows an attacker to supply a crafted module name that is concatenated directly into an include path without proper sanitization, enabling local PHP file inclusion. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
Outline versions before 1.12.0 have an authorization vulnerability in the authorizeDocumentPublish() function. This flaw allows authenticated members to publish documents into private collections without having write access. Exploitation involves detaching a child document using documents.unpublish while retaining the parentDocumentId, then updating the document with a private collection UUID to inject phishing content.
LaraDashboard versions prior to 1.4.9 have a stored cross-site scripting (XSS) vulnerability. Authenticated users with post.create or post.edit permissions can inject malicious scripts via unsanitized LaraBuilder design_json block content. This allows script or event-handler markup to execute in administrator or Superadmin sessions when viewing the builder, preview, or page.
Jpom versions up to 2.11.12 have a cross-workspace authorization bypass vulnerability in the POST /node/ssh_command/batch endpoint. This flaw allows authenticated users with SSH command execution permission in one workspace to run commands on SSH hosts in other workspaces by supplying foreign template and node IDs, bypassing workspace filtering.
Jpom versions through 2.11.12 have a cross-workspace authorization bypass vulnerability. Authenticated users with Docker permissions in any workspace can manipulate Docker hosts in other workspaces by using foreign Docker asset IDs. This allows control over containers, images, volumes, and networks, including the creation of privileged containers with host bind mounts.
LaraDashboard versions prior to 1.4.5 have an authorization vulnerability in the SettingPolicy::manageCoreUpgrades() function. This flaw allows administrators without Superadmin privileges but with settings.edit permission to perform core upgrade operations reserved for Superadmins. Exploitable actions include backup, download, restore, and upgrade of the site, potentially exposing database dumps with password hashes and enabling unauthorized site modifications.
Kvazaar versions through 2.3.2 have an infinite loop vulnerability in the read_header() function of src/encmain.c. This flaw allows attackers to hang the command-line encoder by supplying a crafted .y4m file with a truncated header missing a terminating newline. The vulnerability causes the process to enter an infinite loop, consuming a full CPU core indefinitely.
python-jose versions through 3.5.0 have an authentication bypass vulnerability due to acceptance of zero-length HMAC secrets. This flaw allows unauthenticated attackers to forge JSON Web Tokens (JWTs) with arbitrary claims when the verification key is empty, compromising token integrity and authentication.
libaec versions through 1.1.7 have an out-of-bounds read vulnerability in the m_se_decode() function. This flaw allows attackers to bypass a signed bounds check by using an overlong fundamental sequence in a crafted CCSDS 121.0/SZIP stream. Exploitation can cause the decoder to crash or leak adjacent memory into decoded samples.
L-SMASH versions through 2.14.5 have a heap out-of-bounds write vulnerability in the isom_read_hdlr() and isom_read_dref_entry() functions. This flaw is triggered by crafted MP4 or MOV files that declare handler (hdlr) or URL box sizes larger than the actual remaining data, causing heap corruption and application crashes.
rapidyaml versions through 0.16.0 have an out-of-bounds write vulnerability in the ParseEngine::_add_annotation() function. This flaw allows attackers to corrupt memory by providing YAML input with excessive anchors or tags, which overflow a fixed-size annotation array. The overflow can corrupt stack memory and cause the process to crash.
The Sleuth Kit versions up to 4.15.0 have a NULL pointer dereference vulnerability in the decmpfs_decompress_lzvn_attr() function. This flaw allows attackers to crash the tool by providing a specially crafted HFS+ image with a manipulated LZVN inline com.apple.decmpfs attribute. The vulnerability leads to denial of service due to a failed allocation and subsequent NULL pointer write.
The Sleuth Kit versions through 4.15.0 have a heap out-of-bounds read vulnerability in the hfs_load_extended_attrs() function. This flaw occurs because the function reads the decmpfs header without verifying the attribute length, allowing crafted HFS+ images with specific attribute sizes to cause out-of-bounds reads and crash analysis tools such as istat or icat.
libgphoto2 versions up to 2.5.34 contain stack-based and heap-based buffer overflow vulnerabilities in the jl2005c_init() function. These vulnerabilities allow malicious USB devices, specifically spoofed Jeilin JL2005B/C/D cameras, to supply an unbounded allocation table entry count. This can lead to memory corruption by overwriting the saved return address and heap data, potentially enabling code execution.
A heap out-of-bounds read and write vulnerability exists in libgphoto2 through version 2.5.34 in the jl2005bcd_decompress() function. This flaw allows malicious USB cameras to corrupt heap memory by processing oversized thumbnails. Specifically, attackers can manipulate allocation-table values and a thumbnail header byte to cause in-place byte-swapping to exceed the buffer by approximately 30 KB, potentially leaking heap contents in preview images.
LaraDashboard versions from 1.4.0 up to but not including 1.4.9 have an improper authorization vulnerability. Authenticated users with only read-only email_template.view permission can exploit this flaw to send arbitrary emails through the MCP send-email tool. This allows attackers to generate MCP tokens and send emails with any recipient, subject, and raw HTML content, potentially facilitating phishing or spam campaigns.
DoraCMS versions through 3.1.0 have a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint. This flaw allows authenticated users with low privileges to reassign their API key to another user's account by modifying the userId field. Exploiting this, an attacker can impersonate the victim to alter profiles and publish or delete content.
HotGo versions through 2.15.1 have an authentication bypass vulnerability that allows unauthenticated attackers to specify the SMS login verification code via the /admin/sms/send endpoint. An attacker who knows a user's mobile number can set a known code and then log in through /admin/site/mobileLogin, potentially taking over user accounts, including administrator accounts.
Outline versions before 1.12.0 have an improper access control vulnerability that allows unauthenticated users to read unpublished documents. This occurs because the share loader does not respect the unpublished status of documents. Attackers with an existing share link can access withdrawn content via specific share-related routes, while attempts to revoke shares return a 404 error, preventing revocation.
madong-admin-saas versions through 5.1.4 have a critical missing authentication vulnerability in the platform tenant management API. The 'platformapi' middleware key does not properly match the 'platform' application, allowing unauthenticated remote attackers to access tenant management endpoints. Attackers can list, create, modify, disable, or delete tenants and bind subscription plans without authentication.