Export limit exceeded: 417594 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (417594 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-119038 | 1 Perl | 1 Business::gocardless | 2026-10-30 | N/A |
| Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate. confirm_resource takes no session token from the caller. It reads the redirect flow back from the GoCardless API and completes it with the token from that response, so the check that the flow is completed by the session that started it always passes. It then creates the requested payment or subscription against the flow's mandate. Since version 1.00, a flow that already has a mandate is returned as confirmed without being completed again, so the same ID creates a new payment on every call. A remote attacker who obtains another customer's redirect flow ID can create payments or subscriptions against that customer's mandate. | ||||
| CVE-2026-13576 | 1 Perl | 1 Callbackery | 2026-10-30 | N/A |
| CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give equal hashes, and no work factor slows down guessing. An attacker who obtains the user table can recover passwords by fast offline guessing. | ||||
| CVE-2026-118996 | 1 Perl | 1 Callbackery | 2026-10-30 | N/A |
| CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig. getUserConfig() returns the caller's whole cbuser row, including the stored password hash and the note field that the user interface shows only to administrators. getTableData() and getAllFieldValues() in the user management plugins also return the note to users without the admin right. A non-administrator can read the notes administrators keep about them, and an attacker who obtains a session token can get that user's password hash and crack it offline. | ||||
| CVE-2026-118995 | 1 Perl | 1 Callbackery | 2026-10-30 | N/A |
| CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. createRxValidator() is documented to anchor the supplied pattern at both ends, but builds /^${rx}$/ without grouping the pattern. An alternation such as yes|no then accepts any value starting with yes or ending with no, and $ also accepts a value with one trailing newline. An authenticated user can submit values the pattern was meant to reject, which an application may then write into generated configuration files. | ||||
| CVE-2026-118994 | 1 Perl | 1 Callbackery | 2026-10-30 | N/A |
| CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. login() writes the login name to the application log without escaping control characters. The login RPC method needs no authentication, so a name containing a newline followed by text in the log record format adds a forged record. An unauthenticated attacker can forge log records, such as a successful administrator login from an address of their choosing. | ||||
| CVE-2026-118993 | 1 Perl | 1 Callbackery | 2026-10-30 | N/A |
| CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The before_dispatch hook installed by startup() removes PATH_INFO from the end of the request URI with a substitution that interpolates PATH_INFO unquoted. Under CGI, FastCGI and PSGI both values come from the request, so the client chooses both the pattern and the string it is matched against. A short unauthenticated request with a backreference in the path backtracks exponentially and can keep a worker process busy for minutes. | ||||
| CVE-2026-118992 | 1 Perl | 1 Callbackery | 2026-10-30 | 8.4 High |
| CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup. restoreConfigBlob() feeds the database dump in a backup to the sqlite3 command-line shell. The shell runs lines starting with a dot as its own commands, so .shell or .system in the dump runs an OS command and .load loads native code. Anyone who can supply a backup to be restored can run arbitrary commands as the application user. | ||||
| CVE-2026-118991 | 1 Perl | 1 Callbackery | 2026-10-30 | N/A |
| CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key. getCrypt() pads the backup password with "x" characters and cuts it to 32 bytes to form the AES key, with no salt and no key derivation. The first block of a backup holds a 16 hex digit length field, so decrypting one block confirms a password guess at raw AES speed. An attacker who obtains a backup can recover its password by fast offline guessing, and with it every credential the backup holds. | ||||
| CVE-2026-118990 | 1 Perl | 1 Callbackery | 2026-10-30 | N/A |
| CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup. getConfigBlob() has the sqlite3 shell write the dump to /tmp/cbdump<pid> and never removes it. The file takes the process umask, and a symlink planted at that predictable name is followed. The dump holds every user's password hash and every value saved by the application's forms. A local user can read these after any backup, and may redirect the dump to a file of their choosing. | ||||
| CVE-2026-118987 | 1 Perl | 1 Callbackery | 2026-10-30 | N/A |
| CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header. cookieConf() rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter. The same cookie sent in the X-Session-Cookie header is accepted however old it is. A session cookie that leaks through a log, a Referer header or browser history authenticates as its user indefinitely. | ||||
| CVE-2026-118986 | 1 Perl | 1 Callbackery | 2026-10-30 | N/A |
| CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand(). The secret that signs session cookies is built from two calls to the built-in rand(), which is seeded with 32 bits. The secret therefore has at most 2**32 possible values, and one signed cookie is enough to test each candidate offline. An attacker who obtains a single session cookie can recover the secret and sign cookies for any user, including an administrator. | ||||
| CVE-2026-119596 | 1 Hdinnovations | 1 Unit3d | 2026-10-30 | 4.3 Medium |
| UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/{playlist} endpoint to obtain zips of all torrents, disclosing private collection membership. | ||||
| CVE-2026-119597 | 1 Aidotnet | 1 Opendeepwiki | 2026-10-30 | 9.8 Critical |
| OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys. | ||||
| CVE-2026-119598 | 1 Iluobei | 1 Miaomiaowu | 2026-10-30 | 4.3 Medium |
| Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users' configurations. Attackers can iterate the global auto-increment external_subscription_id parameter to disclose override scripts, filter rules, custom request headers and health-check URLs. | ||||
| CVE-2026-119599 | 1 Looplj | 1 Axonhub | 2026-10-30 | 4.3 Medium |
| AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating service_account API keys with unvalidated scopes. Attackers holding write_api_keys can mint keys with read_channels and query /admin/graphql to read every channel's configuration, including base URLs and model lists. | ||||
| CVE-2026-86715 | 1 Crypttech Crypto And Informatics Technologies Industry And Trade Inc. | 1 Vatos Dlp | 2026-10-30 | 7.1 High |
| Plaintext storage of a password vulnerability in Crypttech Crypto and Informatics Technologies Industry and Trade Inc. Vatos DLP allows Use of Known Domain Credentials. This issue affects Vatos DLP: from 1.1.176 before 1.1.243. | ||||
| CVE-2026-100355 | 1 Basecamp | 1 Once-campfire | 2026-10-30 | 3.1 Low |
| Campfire is a web-based chat application. In version 1.4.4 and earlier, when a Campfire message contains a link, the server fetches it to build an OpenGraph unfurl preview. `RestrictedHTTP::PrivateNetworkGuard` relied on Ruby's `IPAddr#private? `` IPAddr#loopback?`, and `IPAddr#link_local?` predicates plus IPv4-mapped and IPv4-compatible checks, which do not cover several special-use ranges. An authenticated user can post a link to a hostname resolving to CGNAT `100.64.0.0/10`, NAT64 `64:ff9b::/96` or `64:ff9b:1::/48`, or 6to4 `2002::/16` to bypass the guard and cause server-side requests to internal network resources. The NAT64 and 6to4 ranges can embed an internal IPv4 target. Confidentiality impact is limited to returned OpenGraph metadata, and most internal endpoints return none. There is no integrity or availability impact. An initial fix was released in version 1.4.5. | ||||
| CVE-2026-119680 | 1 Manageengine | 1 Sharepoint Manager Plus | 2026-10-30 | N/A |
| A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript into attributes used to generate charts, including users' full names, site names, or group names. The injected content is stored and subsequently executed in the context of other users' browsers when the affected charts are rendered. This vulnerability was fixed in client application build 4508. | ||||
| CVE-2026-119650 | 1 Hulaspark | 1 Hula-server | 2026-10-30 | 5.4 Medium |
| HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requests to /privacy with a target uid parameter to read and overwrite that user's UserPrivacy settings without ownership checks. | ||||
| CVE-2026-119651 | 1 Hulaspark | 1 Hula-server | 2026-10-30 | 5.4 Medium |
| HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying arbitrary feedId values. Attackers can send POST requests to /feed/del with another user's feedId to delete their moments along with associated media, comments, and likes. | ||||