CVE Brief Security Intelligence

WWBN AVideo contains a stored cross-site scripting (XSS) vulnerability allowing authenticated users to inject malicious scripts that execute in the browsers of other users, including administrators.

A server side request forgery vulnerability in Apache Impala allows authenticated users with specific function permissions to exfiltrate secrets from configured credential providers.

The MongoDB Java Driver GridFS component improperly handles file identifiers, allowing authenticated users to manipulate query logic to access, delete, or rename unintended files.

An authenticated, non-admin user can execute arbitrary operating system commands via the ElementSearchController::actionSearch endpoint in Craft CMS.

SiYuan versions before 3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint, allowing authenticated administrators to delete arbitrary files outside the workspace.

A cross-site scripting (XSS) vulnerability in Angular server-side rendering allows attackers to execute arbitrary JavaScript by exploiting improper escaping of input within HTML5 fallback elements.

A cross-site scripting vulnerability in Angular server-side rendering allows attackers to execute arbitrary JavaScript by manipulating ProcessingInstruction DOM nodes.

Angular Server-Side Rendering is vulnerable to SSRF via improper Unicode whitespace trimming in URL parsing, potentially leading to unauthorized credential disclosure.

A stack-based buffer overflow in Tesseract OCR versions 5.5.3 and earlier allows local attackers to cause a denial of service or potentially achieve control-flow hijacking via malicious data files.

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to a denial of service attack, allowing an authenticated remote attacker to delete arbitrary RabbitMQ queues or exchanges.

A memory corruption vulnerability in Netskope Endpoint DLP for Windows allows a privileged user to trigger an integer overflow, potentially leading to arbitrary code execution or privilege escalation.

OpenPanel contains an SQL injection vulnerability in the analytics filter builder that allows authenticated attackers to bypass project isolation and access unauthorized data.

ICEcoder 8.0 through 8.1 contains an OS command injection vulnerability in lib/properties.php, allowing authenticated users to execute arbitrary commands via crafted directory names.

A hardcoded credential vulnerability in Softish EarVision and C6 Ear Camera allows attackers to derive Wi-Fi passwords and gain unauthorized network access.

A Server-Side Request Forgery vulnerability in the Google Gemini Enterprise Agent Platform App Builder allows unauthenticated attackers to leak Compute Engine default service account access tokens.

BurgerEditor contains an unrestricted file upload vulnerability that allows authenticated attackers to execute arbitrary PHP code.

An improper neutralization of special elements in the MongoDB Python Driver GridFS component allows authenticated users to manipulate data queries, leading to unauthorized file access or data deletion.

A query logic flaw in the MongoDB Ruby Driver GridFS component allows authenticated users to manipulate file identifiers, leading to unauthorized file access or data deletion.

A query logic flaw in the GridFS component of the MongoDB PHP Library allows authenticated users to manipulate file identifiers, leading to unauthorized data access or deletion of stored file content.

ICEcoder versions 8.0 through 8.1 are vulnerable to a path traversal flaw in the oldFileName parameter, allowing authenticated users to move arbitrary files on the server.

Renovate improperly handles pagination links from container registries, leading to credential exfiltration when following redirects to attacker controlled hosts.

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain a missing authorization vulnerability that allows authenticated remote attackers to execute arbitrary Python code via custom components.

The Capgo backend improperly validates API key delegation in the x-limited-key-id header, allowing authenticated users to escalate privileges to other keys owned by the same user.

The UsersWP plugin for WordPress is vulnerable to arbitrary file deletion via the upload_file_remove() AJAX handler, allowing authenticated attackers to delete critical system files.

HPE IceWall 4.0 contains a vulnerability involving improper verification of cryptographic signatures in SAML responses, potentially allowing an authenticated attacker to impersonate other users.

Apache Nutch Server (REST API) is vulnerable to code injection and unsafe reflection due to missing authorization, allowing authenticated attackers to execute arbitrary code.

A query logic flaw in the MongoDB C++ Driver GridFS component allows authenticated users to manipulate file identifiers, potentially leading to unauthorized data access or widespread file deletion.

The MongoDB C Driver GridFS component improperly handles file identifiers, allowing authenticated users to manipulate query logic to access unauthorized content or delete file chunks.

A query logic flaw in the MongoDB Rust Driver GridFS component allows authenticated users to manipulate file identifiers, potentially leading to unauthorized data access or widespread file deletion.

The MongoDB C# Driver GridFS component improperly neutralizes special elements in query logic, allowing authenticated users to manipulate file identifiers to access, delete, or rename unintended files.

An OS Command Injection vulnerability in Schneider Electric PowerLogic T300 allows an authenticated user with SSH access to escalate privileges to root and execute unauthorized administrative functions.

Zenius EMS 8.0 is vulnerable to an authentication bypass and input validation failure, allowing remote code inclusion.

A command argument injection vulnerability in Schneider Electric EcoStruxure IT Data Center Expert allows privileged remote code execution via malicious backup configuration parameters.

A stack-based buffer overflow in the Bosch BHI385 SensorAPI allows memory corruption via an unvalidated length byte in debug messages, potentially leading to firmware crashes or arbitrary code execution.

Capgo (capgo.app) suffers from an authentication bypass vulnerability where sessions at the AAL1 level can exercise privileged RBAC permissions, effectively defeating MFA protections.

Howyar WeenyGenius suffers from a missing authentication flaw allowing unauthenticated network-adjacent attackers to spoof endpoints, disrupt classroom operations, or gain unauthorized remote control.

IBM App Connect Enterprise contains an authorization flaw that allows authenticated remote attackers to bypass security restrictions.

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain a code injection vulnerability allowing remote authenticated attackers to execute arbitrary code via an unsafe eval() call.

IBM Langflow OSS versions 1.0.0 through 1.11.5 are vulnerable to OS command injection via improper validation of command-line arguments in the MCP stdio server configuration.

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain a code injection vulnerability caused by an incomplete environment variable blocklist, allowing remote authenticated code execution.

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to OS command injection, which can allow an authenticated remote attacker to execute arbitrary code.

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to path traversal, allowing a remote authenticated attacker to write or delete files on shared storage.

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to an absolute-path traversal flaw, allowing remote authenticated attackers to access sensitive information.

IBM Langflow OSS contains a code injection vulnerability in flow display names that allows remote authenticated attackers to execute arbitrary code.

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an absolute path traversal vulnerability that allows remote authenticated attackers to access sensitive information.

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to OS command injection, allowing a remote authenticated attacker to execute arbitrary code on the underlying system.

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to a Server-Side Request Forgery flaw that allows a remote authenticated attacker to execute arbitrary code.

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary system commands.

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to OS command injection, which could allow an authenticated remote attacker to execute arbitrary code on the underlying system.

IBM Langflow OSS versions 1.0.0 through 1.10.3 are vulnerable to path traversal, which could allow a remote authenticated attacker to achieve arbitrary code execution.

Traefik is vulnerable to an HTTP request handling flaw where opaque request targets allow attackers to bypass routing, authorization, and logging controls by forwarding requests verbatim to backends.

IBM Langflow OSS versions 1.0.0 through 1.11.5 are susceptible to Server-Side Request Forgery (SSRF) due to improper validation of user-supplied URLs.

Autodesk Fusion contains a vulnerability where a malicious add-in can silently modify persistent network proxy settings, potentially enabling traffic interception and sensitive information exposure.

Renovate fails to validate the origin of pagination URLs in NuGet registry responses, allowing unauthenticated attackers to trigger the exfiltration of registry credentials to an arbitrary host.

The SP Property extension for Joomla is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) due to improper output escaping in frontend views and administrator list tables.

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an improper authorization flaw that allows an authenticated remote attacker to cause a denial of service condition.

A Server-Side Request Forgery vulnerability in IBM DataStage on Cloud Pak for Data allows authenticated tenants to perform unauthorized outbound fetches and access internal cluster services.

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability that permits a remote authenticated attacker to overwrite ruleset files belonging to other tenants.

Snipe-IT versions before 8.7.0 are vulnerable to file exfiltration and SSRF due to improper sanitization of the category EULA text field during checkout confirmation emails.

Snipe-IT versions before 8.7.0 are vulnerable to arbitrary file reading and SSRF due to improper sanitization of markdown image syntax in note fields by authenticated users.

OpenNMS Horizon contains a missing authorization vulnerability in its REST API that allows unauthenticated attackers to modify event and SNMP data collection configurations.

A stack-based buffer overflow in the Nintendo Switch local wireless networking functionality allows an unauthenticated attacker within wireless range to execute arbitrary code via crafted network traffic.

WeenyGenius utilizes the insecure ZMTP Null mode, allowing unauthenticated network attackers to intercept sensitive data or execute replay attacks to disrupt classroom operations.

WeenyGenius contains an origin validation error that allows unauthenticated attackers on the same network to spoof teacher workstations via broadcast packets.

IBM Aspera Enterprise WebApps versions 1.0.0 through 1.0.5 contain a vulnerability that allows local attackers to escape container protections via unrestricted system calls.

A logic error in the IBM Langflow OSS static security scanner allows authenticated attackers to bypass security checks and execute arbitrary operating system commands via crafted component source code.

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain an OS command injection vulnerability due to an incomplete denylist in the security scanner, allowing remote code execution for authenticated users.

IBM Langflow OSS allows authenticated users to execute arbitrary operating system commands by bypassing server-side security controls via the MCP Tools component.

FileRun contains an OS command injection vulnerability in the PhotoProofSheet handler allowing authenticated users with upload privileges to execute arbitrary commands via crafted filenames.

Anchor CMS versions through 0.12.7 lack proper authorization checks on user management endpoints, allowing authenticated low-privilege users to escalate privileges to administrator.

The Knowns CLI code generation engine fails to validate destination paths, allowing attackers to perform path traversal to read or write arbitrary files on the host system.

ICEcoder versions 8.0 through 8.1 contain a path traversal vulnerability in the file-control endpoint, allowing authenticated attackers to access files outside the intended document root.

WWBN AVideo contains a stored cross-site scripting vulnerability in the LoginControl plugin that allows authenticated users to execute malicious scripts in administrator sessions.

The LiveLinks plugin in WWBN AVideo is vulnerable to stored cross-site scripting due to insufficient input sanitization of title and description fields, allowing authenticated users to execute scripts.

Tesseract OCR engine is vulnerable to a heap-based out-of-bounds write flaw caused by insufficient validation of loop bounds when parsing crafted traineddata files, leading to potential memory corruption.

Tesseract OCR is vulnerable to a heap out-of-bounds write due to missing validation of model data, potentially allowing arbitrary code execution or system crashes via a crafted .traineddata file.

A heap out of bounds write vulnerability exists in Tesseract OCR versions 5.5.3 and earlier due to unchecked bounds in LSTM processing functions, potentially leading to heap corruption or code execution.

A heap out-of-bounds vulnerability in Tesseract OCR allows for potential memory corruption or information disclosure via crafted .traineddata files.

A path traversal vulnerability in Advanced Product Fields Extended for WooCommerce allows unauthenticated attackers to delete arbitrary files.

Renovate fails to validate Link header destinations during GitLab pagination, enabling unauthenticated attackers to redirect requests and exfiltrate sensitive authentication credentials.

Renovate incorrectly follows untrusted pagination links in HTTP headers, potentially causing the tool to disclose sensitive credentials to attacker-controlled hosts.

A Server-Side Request Forgery (SSRF) vulnerability in Schneider Electric EcoStruxure IT Data Center Expert allows privileged attackers to execute unauthorized commands and access sensitive server data.

Bestzip contains an argument injection vulnerability in the nativeZip function that allows attackers to execute arbitrary commands with Node.js process privileges.

A vulnerability in the SICK Sentio Creator Extension Device Manager allows unauthenticated remote attackers to execute arbitrary code via malicious driver packages due to improper signature verification.

HashiCorp Consul and Consul Enterprise contain an authorization bypass in the catalog node-write path, allowing authenticated attackers to delete and assume the identity of other nodes.

OpenPanel fails to enforce read-only access controls on 26 of 29 mutation procedures, allowing low-privileged users to modify, delete, or publish sensitive project data.

A cross-site scripting vulnerability in Open WebUI allows authenticated users to compromise other accounts by injecting malicious scripts into terminal port previews.

The zstd-jni library contains an out-of-bounds read vulnerability in the Zstd.getFrameContentSize function, allowing attackers to trigger information disclosure or JVM crashes via negative offsets.

MaxSite CMS contains a local file inclusion vulnerability in its ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute arbitrary handler files via path traversal.

A vulnerability in zstd-jni allows out-of-bounds memory reads via negative or overflowing offsets in direct-ByteBuffer frame-size native methods, potentially causing JVM termination or data exposure.

Chainlit versions through 2.12.0 are vulnerable to path traversal via the socket.io sessionId parameter, allowing unauthenticated attackers to delete arbitrary directories accessible to the service process.

The zstd-jni library fails to validate offset and length parameters in the ZstdDictCompress constructor, enabling out-of-bounds memory reads that can trigger JVM crashes.

The knowns npm package contains a path traversal vulnerability in the Document API, allowing unauthenticated remote attackers to read, write, or delete arbitrary files on the host filesystem.