Base de CVEs

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitted checks include cluster-scoped and namespaced resource allow/deny lists. A user who can write to an Application's Git repository can commit a delete hook targeting a forbidden namespace, server, group, kind, or resource name, and deletion of the Application causes the application-controller to create that resource with its destination-cluster credentials. The reachable impact is bounded by the controller's cluster access but can include cluster-scoped resources, disallowed namespaces, persistent hook objects, and secondary objects created by a hook Job. PreSync, Sync, PostSync, and SyncFail hooks continue to use the normal project checks. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.full_name value into HTML without applying encode_entities and inserts the result through this.div.html. The bundled pixl-server-user input filter can be bypassed by a tag containing a line break because its regular expression does not match newlines. An authenticated non-administrator can update the attacker's own name through /api/user/update using a valid session and current password; when free_accounts is enabled, an anonymous attacker can instead plant the name during self-registration. The stored name executes script in an administrator's session when the Activity Log is opened, enabling administrator takeover and subsequent command execution through privileged Cronicle features. This issue is fixed in version 0.9.119.

RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin *, and --rc-serve. A malicious web page opened by a user while the daemon is running can therefore send cross-origin requests to the unauthenticated local API with the user's operating-system privileges. The requests can disclose configured storage credentials and potentially access, upload, modify, or exfiltrate locally stored files accessible to the user and files available through configured remotes; the advisory's possible command-execution impact remains unconfirmed. This issue is fixed in version 0.2.7.

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the web-accessible temporary directory. An authenticated user with Import privileges can select the affected import path and upload a PHP file that remains under an attacker-controlled executable filename, and an import error can leave the file on disk. If the temporary directory is served with PHP execution enabled, requesting the staged file can execute arbitrary PHP code with the web server process privileges, exposing or modifying recruiting data and the host system. This issue is fixed in version 0.10.0.

Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows unauthenticated attackers to write arbitrary files. Attackers can send crafted fullPath and fileName parameters to POST /rest/storeFile to create or overwrite service-writable files, potentially achieving code execution.

An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.

An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application.

TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 for @tanstack/vue-start, an unauthenticated attacker can place non-public fields in a server-function request payload so that attacker-controlled middleware state reaches the error path and a response-shaped object is accepted as an HTTP response. A crafted server-function URL can therefore return attacker-controlled HTML from the application's origin; when a visitor opens the URL, the injected script can access same-origin data and issue requests with the visitor's authority. This issue is fixed in @tanstack/start-server-core 1.169.39, @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, and @tanstack/vue-start 1.168.56.

An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code.

FearlessCMS é um sistema de gerenciamento de conteúdo baseado em arquivos planos, focado em simplicidade e código aberto. Nas versões 0.1.2b e anteriores, um administrador autenticado pode definir uma URL arbitrária de repositório Git por meio de admin/updater-handler.php e acionar perform_update, que repassa a URL para update.sh. O atualizador clona o repositório e substitui os diretórios ativos plugins/, admin/ e includes/ sem verificar a identidade, as assinaturas ou o conteúdo do repositório. Como o router.php permite que arquivos PHP existentes em plugins sejam executados pelo servidor de desenvolvimento PHP, conteúdo de atualização fornecido por um atacante pode executar PHP arbitrário com os privilégios do processo do servidor web e persistir como backdoor. Este problema foi corrigido na versão 0.1.3b.

O repositório de documentação da Salty constrói e publica o site docs.saltbox.dev. Antes do commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, o arquivo .github/workflows/trigger-pr-build.yml registra um commit não confiável de fork no artefato pr_info, e o job workflow_run com segredos em .github/workflows/build-pr.yml faz checkout desse commit antes de executar pip install -r requirements.txt. Assim, um pull request de fork pode fornecer setup.py ou hooks de build PEP 517 escritos pelo atacante, cuja instalação é executada no workflow privilegiado do repositório base com CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY e um GITHUB_TOKEN com permissão de escrita, permitindo divulgação de segredos e comprometimento posterior. A vulnerabilidade não é causada pela proteção de bloqueio de forks, e o caminho demonstrado exige controle do atacante sobre o conteúdo do fork, e não apenas sobre os metadados do artefato. Esta vulnerabilidade foi corrigida pelo commit 649c9aea2daef1168eeb0415b44e65dbbde9f220.

Metabase é uma plataforma open source de business intelligence e análise de dados. Das versões 1.55.0 até 1.58.16, 1.59.13, 1.60.9 e 1.61.4, consultas nativas e ações contra uma fonte de dados H2 são repassadas sem restringir funções internas do H2 voltadas ao host. Um usuário autorizado a executar consultas nativas ou ações pode invocar FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE ou LINK_SCHEMA para ler ou gravar arquivos arbitrários no servidor do Metabase ou vincular outros bancos de dados. O banco de dados de exemplo padrão usa H2, portanto a superfície vulnerável fica exposta por padrão. Este problema está corrigido nas versões 1.58.16, 1.59.13, 1.60.9 e 1.61.4.

An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId cookie.

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request.

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.

O CVFS continha um problema de validação de entrada que afeta a execução de comandos. Clientes de software devem atualizar para a versão de manutenção corrigida. Atualize o CVFS.

MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() creates a platform administrator when the token subject matches PLATFORM_ADMIN_EMAIL and REQUIRE_USER_IN_DB is false. A remote unauthenticated attacker can therefore mint accepted administrator tokens without a database account. While the vulnerable signing key remains configured and the platform-admin bootstrap remains enabled, forged access survives password rotation, account deletion, and session revocation, allowing administrative disclosure, modification, and service disruption. This issue is fixed in version 1.0.2.

Dragonfly é um armazenamento de dados em memória criado para cargas de trabalho modernas de aplicações. Antes da versão 1.40, OpaqueObjLoader::CreateStream em src/server/rdb_load.cc pode associar um streamNACK à PEL global de um grupo de consumidores e a uma PEL local de consumidor, e depois liberar o objeto compartilhado quando uma entrada duplicada de consumidor é rejeitada. A limpeza posteriormente libera o mesmo objeto novamente. Na configuração padrão, em que o Dragonfly é distribuído com a autenticação desabilitada, um cliente não autenticado pode acionar o double-free enviando um stream serializado malformado para RESTORE, causando corrupção do alocador, negação de serviço e, potencialmente, execução de código controlada pelo atacante como a conta de serviço do Dragonfly. A correção no código-fonte ainda não foi associada a uma versão publicada.

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filename, bypassing REST controller validation, to write files as the wazuh user.

Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT command localfile that the collector runs as root on reload.

Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files. Attackers controlling a worker can use a trailing-slash basename bypass and missing extra_valid enforcement to overwrite ossec.conf and agent.conf, achieving root remote code execution across the manager and every agent.

NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crafted token-revocation lists. A successful exploit may lead to data tampering and denial of service.

O NVIDIA AIStore para Linux contém uma vulnerabilidade na API legada de inicialização de PodSpec do Kubernetes para ETL, na qual um invasor remoto pode fornecer configurações de namespace de host e de segurança de contêineres do Kubernetes. Uma exploração bem-sucedida pode levar a execução de código, escalonamento de privilégios, divulgação de informações, adulteração de dados e negação de serviço.

Sandbox escape in the DOM: Content Processes component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.