ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting (XSS) vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if the malicious images are embedded in an `iframe` element, during a widget creation, deployed to any page of the platform (e.g., dashboards), and accessed during normal operations. The vulnerability resides in the `ImageController`, which fails to restrict the execution of JavaScript code when an image is loaded by the user's browser. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions.
Disclosed Vulnerabilities
Checkmarx Zero is working on making the world a safer place by finding, disclosing, and helping to fix open-source vulnerabilities. Below are the vulnerabilities we’ve disclosed in our role as a CNA (CVE Numbering Authority) via the MITRE CVE process.
cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters (" ") when those are prefixed with a null byte. This enables attackers to exploit CRLF injection that could further lead to HTTP Response Splitting, XSS, and more.
Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin interface. The vulnerability exists in the "displayable_links_js" function, which fails to properly sanitize blog post titles before including them in JSON responses served via "/admin/displayable_links.js". An authenticated admin user can create a blog post with a malicious JavaScript payload in the title field, then trick another admin user into clicking a direct link to the "/admin/displayable_links.js" endpoint, causing the malicious script to execute in their browser.
A Code Injection vulnerability in the file ThreeMFReader.py allows attackers to distribute malicious models which will trigger code injection vulnerabilities. This issue affects UltiMaker Cura: from v5.7.0-beta.1 through v5.8.0-beta.1
A Stored Cross-Site Scripting (XSS) vulnerability in the “Services” tab of the Device page of the `@LibreNMS/LibreNMS` project allows authenticated users to inject arbitrary JavaScript through the `descr` parameter when adding a service to a device.
A Stored Cross-Site Scripting (XSS) vulnerability in the “Custom OID” tab of the `@LibreNMS/LibreNMS` project allows authenticated users to inject arbitrary JavaScript through the `unit` parameter when creating a new OID. The payload executes in the “Unit” column of the Custom OID table, potentially compromising other users’ sessions.
A Reflected Cross-Site Scripting (XSS) vulnerability in the “metric” parameter of the “/wireless” and “/health” endpoints in the `@LibreNMS/LibreNMS` project allows attackers to inject arbitrary JavaScript that executes when the page is loaded.
A Stored Cross-Site Scripting (XSS) vulnerability in the Device Overview page allows authenticated users to inject arbitrary JavaScript through the `overwrite_ip` parameter when editing a device. The injected script executes in the “Assigned IP” field on page load, potentially compromising other users’ sessions.
A Stored Cross-Site Scripting (XSS) vulnerability in the “Port Settings” page allows authenticated users to inject arbitrary JavaScript through the `descr` parameter when editing a device’s port settings, which then executes when the page is viewed.
A Stored Cross-Site Scripting (XSS) vulnerability in the “Services” section of the Device Overview page allows authenticated users to inject arbitrary JavaScript through the `name` parameter, resulting in code execution in other users’ sessions.
A Reflected Cross-Site Scripting (XSS) vulnerability in the "logs" tab of a device in the `@LibreNMS/LibreNMS` project allows attackers to inject arbitrary JavaScript via the `section` parameter, leading to code execution when the page is loaded.
A Stored Cross-Site Scripting (XSS) vulnerability in the Port Settings page allows authenticated users to inject arbitrary JavaScript through the `name` parameter when creating a new Port Group. This payload executes when the Port Settings page is visited after the Port Group is added to a device, compromising user sessions and enabling unauthorized actions.
A Stored Cross-Site Scripting (XSS) vulnerability in the “Capture Debug Information” page allows authenticated users to inject arbitrary JavaScript through the `hostname` parameter when creating a new device. The injected script executes when the Capture Debug Information page is visited, redirecting the user and sending non-httponly cookies to an attacker-controlled domain.
A Stored Cross-Site Scripting (XSS) vulnerability in the Manage User Access page allows authenticated users to inject arbitrary JavaScript through the bill_name parameter when creating a new bill. The injected script executes in the Bill Access dropdown on the Manage Access page.
The `Create Package` functionality in the `@umbraco/Umbraco-CMS` package contains a path traversal vulnerability that allows a user to specify a relative or absolute path as the package name. This can result in the creation or overwriting of files outside the intended directory. The issue has been addressed by sanitizing the package name input to prevent path traversal. The fix was released in the following versions: 8.18.10, 10.8.1 and 12.3.4.
A Stored Cross-Site Scripting (XSS) vulnerability in the "Device Dependencies" feature of the `@LibreNMS/LibreNMS` project allows authenticated users to inject arbitrary JavaScript through the device name (`hostname` parameter). This script executes when another user views the Device Dependencies page, potentially redirecting them to attacker-controlled sites and exposing session cookies.
A Self Cross-Site Scripting (Self-XSS) vulnerability in the "Alert Templates" feature of the `@LibreNMS/LibreNMS` project allows users to inject arbitrary JavaScript into the alert template’s name. This script executes immediately upon submission but does not persist after a page refresh.
A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Rules" feature of the `@LibreNMS/LibreNMS` project allows authenticated users to inject arbitrary JavaScript through the "Title" field. The injected script executes when the alert rules page loads, redirecting users to attacker-controlled domains and exposing session cookies.
A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Transports" feature of the `@LibreNMS/LibreNMS` project allows authenticated users to inject arbitrary JavaScript through the "Details" section. The injected script executes in other users’ sessions when transport details are viewed, potentially compromising accounts and enabling unauthorized actions.
The package `Umbraco Commerce` contains a stored XSS vulnerability in the Print functionality. When a user submits arbitrary JavaScript within the Billing/Shipping information during a purchase, this payload is stored and executed when an admin attempts to print the order in the backoffice. This can lead to the execution of malicious code with the possibility of privilege escalation or data compromise. The issue was addressed by sanitizing the user input before rendering the print page. The fix was released in the following versions: 12.1.4 and 10.0.5.
A stored XSS vulnerability exists in the `Title and Description` component of the Umbraco Forms package. Users with access to edit forms can inject arbitrary JavaScript into the `BodyText` and `CaptionTag` fields, which are rendered as HTML when the form is displayed. The fix was released in the following versions: 13.0.1, 12.2.2, 10.5.3 and 8.13.13.
A stored XSS vulnerability exists in the Content page of `@umbraco/Umbraco-CMS` through the Markdown Editor’s preview pane. This vulnerability allows an attacker with Editor permissions to inject arbitrary JavaScript into the markdown content. When an administrator reviews or publishes this page, the XSS is triggered, leading to a full compromise of the application. The issue was fixed by sanitizing the HTML content before rendering it in the preview pane. The fix was released in the following versions: 8.18.13, 10.8.4, 12.3.7 and 13.1.1
The package `@umbraco/Umbraco-CMS` contains a DOM-based XSS vulnerability in the login functionality. The vulnerability occurs in the `login.controller.js` file, where a user-supplied `returnPath` parameter is not properly validated, allowing for the injection of malicious JavaScript. Attackers can exploit this by crafting a URL that triggers XSS once a user logs in, potentially gaining access to elevated privileges if an administrator uses the malicious link. The issue was addressed in Umbraco versions 10.8.1 and 12.3.4 by validating the `returnPath` parameter.
Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call. This issue affects snipe-it: from v4.6.17 through v6.4.1.
The sylius package is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in various components of the Admin panel.
The NPM package `braces` fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js`, if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything, which can cause the application to hang or slow down. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to its greedy matching. This issue was fixed in version 4.0.8.
The Strapi Web Application is missing input validation in its file upload feature in versions prior to 4.22.0 which leads to Denial of Service. This vulnerability allows an attacker to crash the node server, affecting either development and production environments.
A critical security flaw is present in the Python `Pillow` package in versions prior to 10.2.0. If an attacker has control over the keys passed to the environment argument of `PIL.ImageMath.eval()`, they may be able to execute arbitrary code. To prevent this, keys matching the names of builtins and keys containing double underscores will now raise a `ValueError`.
EverShop Web Application in versions prior to 1.0.0-rc.8 contains a Reflected Cross-Site Scripting (XSS) vulnerability. Attackers can exploit this issue by adding a second "sortBy" parameter to the request. This unexpected behavior will return the second "sortBy" value in the page's code, potentially enabling the successful execution of XSS payloads.
The EverShop Web Application is missing input validation in the function 'readdirSync' in 'browser.js' in versions prior to 1.0.0-rc.8 which leads to Relative Path Traversal. This vulnerability allows an attacker to list all the folders and files on the filesystem through the API endpoint '/api/files'.
A Broken Function Level Authorization vulnerability in the "route.json" file of the EverShop web application in versions prior to 1.0.0-rc.8 allows unauthenticated attackers to delete customer accounts through a publicly accessible GraphQL endpoint. Attackers can chain this with another vulnerability found in the GraphQL schema, first by querying the schema to identify the "Customer" object and get the relevant "uuid" of a user. Then the attackers are able to send a DELETE request to the unprotected endpoint, resulting in the successful deletion of the user account. This was fixed by closing public access to the endpoint so it requires users to be authenticated with 'admin' credentials in order to request it.
EverShop web application in versions prior to 1.0.0-rc.8 is missing input validation in the function 'mkdirSync' in 'createFolder.js', leading to a Relative Path Traversal vulnerability that enables arbitrary folder creation. From the feature for adding an image to a Product's "Description" field, attackers can create a new folder in unintended locations by navigating backward with "../", potentially affecting system processes.
EverShop web application in versions prior to 1.0.0-rc.8 is missing input validation in the function 'unlinkSync' in 'deleteFile.js', leading to a Relative Path Traversal vulnerability that enables arbitrary file deletion. This vulnerability extends beyond path traversal since the endpoint "/api/files" allows "DELETE" requests which then allow for file deletion across the filesystem.
A critical security flaw is present in the EverShop Web Application in versions prior to 1.0.0-rc.8. The HMAC secret used for generating tokens is hardcoded as "secret". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens (JWTs), allowing them access to important information and actions within the application. This vulnerability has been fixed by implementing session authentication.
Lack of authentication in GraphQL in the EverShop Web Application in versions prior to 1.0.0-rc.8 allows any user to access sensitive data without proper authorization.
Python's package Pillow prior to 10.0.0 allows attackers to cause a Denial of Service when using arbitrary strings as text input in "ImageFont" methods that calculate text size or render text to an image. The number of characters passed to these methods is not properly checked, potentially causing a service to crash by having it run out of memory.
EverShop Web Application in versions prior to 1.0.0-rc.5 contains a Stored Cross-Site Scripting (XSS) vulnerability affecting various functionalities of the Admin Panel. Attackers can particularly inject malicious code during the creation of new products. The registration of users is also affected, which means that an unauthenticated user could store malicious code during registration which will affect administrators that visit the users' section. The latter could lead to more serious attack vectors, including account takeover.
EverShop Web Application in versions prior to 1.0.0-rc.5 contains a Reflected Cross-Site Scripting (XSS) vulnerability in the Admin Panel. This security flaw allows attackers to inject malicious code into the application's admin panel, particularly in the "Product Name" and "SKU" input fields when searching for products, leading to the execution of unauthorized JavaScript code in the browser. Other similar input fields are also affected.
A path traversal vulnerability leads to arbitrary file write in nopCommerce version 4.50.3 and below
Cross-site Scripting (XSS) in parse-url prior to version 6.0.0 and in 6.0.2.
Authorization Bypass Through User-Controlled Key in emicklei/go-restful prior to version 3.8.0.
A ReDoS (Regular Expression Denial of Service) vulnerability exists in GitPython before 3.1.27.
Cross-Site Scripting in silverstripe/silverstripe-assets through 1.10.0.
Stored XSS in silverstripe/silverstripe-framework versions 4.x.x prior to 4.10.9.
Failure to strip Authentication header on HTTP downgrade in guzzle/guzzle prior to 6.5.7 and 7.x prior to 7.4.4
Unvalidated Follow Redirects in guzzle/guzzle prior to 6.5.7 and 7.x prior to 7.4.4.
Set cookie for different domain in guzzle/guzzle prior 6.5.6 and 7.x prior to 7.4.3
'?' before the '@' sign in HTTP URLs allows whitelist bypasses in parse-url through 6.0.0, and versions 6.0.2, 6.0.3, 6.0.5
Malicious usage of '+' in protocol can lead to whitelist bypasses in parse-url through 6.0.0, and versions 6.0.2, 6.0.3, 6.0.5
Open Redirect in parse-url through 6.0.0, and versions 6.0.2, 6.0.3, 6.0.5
Hostname Spoofing via Improper Input Validation in parse-url through 6.0.0, and versions 6.0.2, 6.0.3, 6.0.5
Improper Input Validation in parse-url through 6.0.0, and versions 6.0.2, 6.0.3, 6.0.5
Exposure of Sensitive Information to an Unauthorized Actor in parse-url version 6.0.2 and prior to 6.0.1.
Authentication Bypass by Primary Weakness in parse-url through 6.0.0, and versions 6.0.2, 6.0.3, 6.0.5
Arbitrary File Write in gruntjs/grunt prior to 1.5.3.
Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2.
Hostname is not detected because of improper handling of username and password. (Based on real cases)
spoofing of the javascript protocol itself
Sensitive headers are uncleared on cross-port redirect
Authenticated RCE through /admin/settings/email endpoint in craftcms/cms
Spring Cloud Function exposes more functions than intended.
Spring Cloud Function through the web endpoint is vulnerable to DoS.
Improper Neutralization of Equivalent Special Elements in `loguru` can lead to Log Injection on all logging methods. It is possible to inject newlines (' ') which will create a new log entry in the logfile. This can lead to attackers tampering with logs and a loss of integrity of the log files as a result.
Improper Privilege Management in Conda 'loguru' can allow an unprivileged user to read log files and disclose sensitive information.
A ReDoS (Regular Expression Denial of Service) vulnerability exists in `GitPython`.
SilverStripe Framework is vulnerable to Business Logic Errors in the Failed login count since that value can be a negative number.
The `url-parse` npm package allows authorization bypass through user-controlled key. Bypasses `https://hackerone.com/reports/496293` via `` (backspace) character.
The `url-parse` NPM package allows authorization bypass through user-controlled key. When no port number is provided in the 'url', url-parse is unable to find the correct hostname.
Authorization Bypass through User-Controlled Key in NPM `url-parse`. An incorrect conversion of `@` in protocol in `href` leads to improper validation of the hostname.
The `url-parse` npm package allows Authorization Bypass through user-controlled key. It improperly handles username and password, and ìt's unable to detect the hostname.
XSS exists in the XMALL admin panel via the GET parameter in product-add.jsp
The ModuleXmlParser.parse() function makes use of SAXParser generated from a SAXParserFactory with no FEATURE_SECURE_PROCESSING set, allowing for XXE attacks.
Deserialization issues in the Dubbo pipeline allows submitting a malformed gadget object to a Dubbo endpoint, resulting in RCE.
Deserialization attack via JDBCAppender's DataSource element in log4j
A stored cross-site scripting (XSS) vulnerability exists in FileBrowser < v2.16.0 that allows an authenticated user authorized to upload a malicious .svg file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger malicious OS commands on the server running the FileBrowser instance.
NPM package ssh2 prior to 1.0.0 is vulnerable to command injection through the unsafe execution of user-controlled parameters.
All versions of the NPM package `@stoqey/gnuplot` are vulnerable to command injection. The function `plotCallack` receives and executes unsanitized input that is controlled by the user.
Code Execution Vulnerability Discovered in CTparetnal due to directory traversal.
CSRF Vulnerability Discovered in the CTparental admin panel.
Reflected XSS Vulnerability Discovered in CTparetnal, in the file 'bl_categories_help.php'.
The coveralls npm package allows OS Command Injection via shell metacharacters, as demonstrated by getBaseOptions().
Prototype pollution via the extend function in extend2
Prototype pollution via the clone and extend functions in cloneextend
An unauthenticated SQL Injection in Heimdall Gateway may allow remote compromise of the database.
Arbitrary File Read Vulnerability Discovered in GoWitness before 2.3.6, which enables attackers to read files from the host when acting as a Screenshot Server.
Authenticated Command Injection Vulnerability Discovered in RaspAP before 2.6.6, which combined with CVE-2021-33356 could lead to RCE with root privileges.
Unauthenticated Command Injection Vulnerability Discovered in RaspAP before 2.6.6, which combined with CVE-2021-33356 could lead to RCE with root privileges.
Privilege Escalation Vulnerability Discovered in RaspAP before 2.6.6, which combined with CVE-2021-33357 or CVE-2021-33358 could lead to RCE with root privileges'.
Path Traversal Vulnerability Discovered in Impacket before 0.9.23, which could lead to RCE depending on the environment and the operating system.
Stored XSS Vulnerability Discovered in CKEditor4.
Deserialization RCE attack in replicator npm package via the TypedArrays objects
The @rkesters/gnuplot package prior to version 0.1.0 allows code execution via shell metacharacters in Gnuplot commands.
the gitDiff function of git-parse is vulnerable to command injection vulnerability
Gnuplot Command Injection in plotframes through the `plotScript()` function
OS Command Injection in plotter through the `plot()` function
Gnuplot Command Injection in gnu-plot through the `set()`, `plot()`, and `splot()` functions
docker-tester allows command injection via a crafted docker-compose file.
The lifion-verify-deps npm package allows OS Command Injection via a crafted package.json file.
Command Injection in jandoc
Command Injection in gnuplot-heatmap through the `outFile` option
Command Injection in azure-gs through the `exec()` function
All versions of the ssl-utils Node.js package are vulnerable to command injection via the createCertRequest() and createCert() methods.
OS Command Injection in ebook through the `Pandoc()` and `KindleGen()` functions
All versions of the proctree Node.js package are vulnerable to command injection. Exploitation is possible via unsanitized shell metacharacters provided to the getProcessTree() function.
gitsome through 0.2.3 is vulnerable to RCE via crafted git tag names.
The curl function in curl-ganteng has a command injection vulnerability. In case the input is untrusted RCE can be achieved.
When receiving a response from a server with 'Content-Type: javascript' reqwest will automatically eval the content.
Remote command injection vulnerability in google-it up to version 1.6.2
The latest version of s3-uploader is vulnerable to command injection via the getMetadata() function.
The opened @ronomon/opened library up to 1.5.1, a node api used for checking if a certain file is opened on a system, is vulnerable to a command injection vulnerability which would allow a remote attacker to execute commands on the system if the library was used with untrusted input.
Apostrophe Technologies sanitize-html does not properly validate the hostnames set by the allowedIframeHostnames option when the allowIframeRelativeUrls is set to true.
sanitize-html does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname validation.
url-parse before 1.5.0 parses URLs with backslash in the protocol as relative path, such as `http:/`
urijs before 1.19.6 parses URLs with backslash in the protocol as relative path, e.g.`http:/`
DoS vulnerability in get-ip-range before 4.0.0 passing a large ip-range could result in JavaScript heap out of memory crash
The samba-client library for NodeJS before version 4.0.0 suffers from a command injection vulnerability. In the cases that this library is used in a project where the connection parameters may be defined by untrusted input, a malicious actor will be able to use this to inject malicious commands in the server hosting the Node JS application.
LFI vulnerabilities in Pixel Caffeine Wordpress plugin, by leveraging the LFI into an XSS, RCE could be achieved.
In Mozilla Bleach before 3.3.0, a mutation XSS affects users calling bleach.clean with svg/math, p/br, one of the RCDATA tags, and comments allowed.
All versions of eslint-fixer Node.js package are vulnerable to command injection. Exploitation is possible via unsanitized shell metacharacters provided to the fix() function.
When using config-shield in CLI mode, malicious code could be executed when passed through the 'set' command.
The async-git npm package allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag.
CSRF in the settings page of Elementor-Contact-Form-DB wordpress plugin
The loadFromGit function in index.cjs.js has a command injection vulnerability. Clients of the library are unlikely to be aware of this, so they might unwittingly write code that contains.
The gitlog function in src/index.ts has a command injection vulnerability. Clients of the gitlog library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.
In Twitter-server before 21.12.0, a reflected XSS exists in the administration panel of twitter-server in the histograms component.
CSRF and XSS vulnerabilities in site-offline resulting in an RCE
Open redirect vulnerability in Jupyter server via the /login?next= path
CSRF in the settings page of ultimate-category-excluder wordpress plugin
Drupal core's built-in CKEditor image caption functionality is vulnerable to XSS.
Reflected XSS and CSRF in Powerpress Wordpress plugin admin page, which can result in an RCE
lxml utilize parser that doesn't imitate browsers, versions before 4.6.2 are vulnerable to mutation XSS.
A reflected DOM-based XSS was identified in Drupal Core, which allows an attacker to craft a web-page that would send a request to the`edit node` or `add node` endpoint and will be reflected in the victim's browser.
Reintroduced ReDoS vulnerabilty (CVE-2017-16137) in debug from version 4.0.0 up to 4.3.0
In Apache Unomi before 1.5.2 is vulnerable to a remote code execution vulnerability by sending malicious requests with MVEL an OGNL expressions.
Reflected XSS on an admin page in Paid Memberships Pro, which can potentially result in an RCE
MoinMoin before 1.9.11 is vulnerable to an XSS attack, by uploading a SVG file that contains malicious javascript code.
SQL Injection in phpMyAdmin through `SearchController`
SSRF vulnerability when installing a plugin causing arbitrary file download
CSRF vulnerability in the marketplace plugin download request
Stored XSS in the folder name variable in Codiad
Minist before version 1.2.3 or 0.2.1 is vulnerable to prototupe pollution because the arguments are not properly sanitized.
In Mozilla Bleach before 3.1.2, a mutation XSS affects users calling bleach.clean with svg or math and a style tags allowed.
In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option.
Open redirect vulnerability in the GoLang package i18n via double slash.
Unsafe deserialization vulnerability in Apache Dubbo which has HTTP remoting enabled, could allow to trigger remote code execution with no authentication.
With a given a permission to write and set permissions on a file in the same working directory as the application, an attacker could run arbitrary command on the server
DOM XSS in the stored history field of Prometheus
Open redirect vulnerability in the GoLang package i18n via double slash - '//'
A Denial of Service (DoS) vulnerability in the file ecstatic.js of the ecstatic npm package, before version 2.0.0, allows a remote attacker to overload and crash a server by passing a maliciously crafted string.
An HTML Injection in Securimage 3.6.4 and earlier allows remote attackers to inject arbitrary HTML into an e-mail message body via the $_SERVER['HTTP_USER_AGENT'] parameter to example_form.ajax.php or example_form.php.
A Cross-site scripting (XSS) vulnerability in the Security component of Kohana before 3.3.6 allows remote attackers to inject arbitrary JavaScript by bypassing the strip_image_tags protection mechanism
No vulnerabilities match this filter.
