Real-Time CVE Alerts & Vulnerability Tracker

No title available

In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably configured non legitimate issuer being accepted as a token belonging to a service account from a legitimate trusted issuer. Exploitation requires a service account with at least one OIDC identity configured. An attacker would also need to know or guess some details of that identity in order to be in a position to attempt exploitation.

Push Endpoint Returns Permissive CORS Headers

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to false and its CorsInterceptor then echoes whatever Origin the request carries. A page on any origin can therefore make a cross origin request to that endpoint with the user's cookies and read the response, although reading anything useful also requires the push identifier of that session. Applications that do not use @Push are not affected, and neither is the WebSocket transport. The behaviour was introduced in January 2015 and is present in every Flow release and in Vaadin Framework from 7.1.0, which is when push was added. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 14.14.0 - 14.14.7 Vaadin 23.6.0 - 23.6.16 Vaadin 24.4.0 - 24.4.25 Vaadin 24.5.0 - 24.5.15 Vaadin 24.6.0 - 24.6.13 Vaadin 24.7.0 - 24.7.16 Vaadin 24.8.0 - 24.8.17 Vaadin 24.9.0 - 24.9.23 Vaadin 24.10.0 - 24.10.11 Vaadin 25.0.0 - 25.0.13 Vaadin 25.1.0 - 25.1.13 Vaadin 25.2.0 - 25.2.10 Vaadin 25.3.0 - 25.3.2 Vaadin Framework 7.1.0 - 7.7.54 Vaadin Framework 8.0.0 - 8.32.1 Mitigation Upgrade to 14.14.8 Upgrade to 23.6.17 Upgrade to 24.4.26 Upgrade to 24.7.17 Upgrade to 24.7.17 Upgrade to 24.7.17 Upgrade to 24.9.24 Upgrade to 24.9.24 Upgrade to 24.10.12 Upgrade to 25.2.11 Upgrade to 25.2.11 Upgrade to 25.2.11 Upgrade to 25.3.3 Upgrade to 7.7.55 Upgrade to 8.32.2 Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version. Artifacts Maven coordinates / Vulnerable versions / Fixed version com.vaadin:vaadin / 14.14.0 - 14.14.7 / >=14.14.8 com.vaadin:vaadin / 23.6.0 - 23.6.16 / >=23.6.17 com.vaadin:vaadin / 24.4.0 - 24.4.25 / >=24.4.26 com.vaadin:vaadin / 24.5.0 - 24.5.15 / >=24.7.17 com.vaadin:vaadin / 24.6.0 - 24.6.13 / >=24.7.17 com.vaadin:vaadin / 24.7.0 - 24.7.16 / >=24.7.17 com.vaadin:vaadin / 24.8.0 - 24.8.17 / >=24.9.24 com.vaadin:vaadin / 24.9.0 - 24.9.23 / >=24.9.24 com.vaadin:vaadin / 24.10.0 - 24.10.11 / >=24.10.12 com.vaadin:vaadin / 25.0.0 - 25.0.13 / >=25.2.11 com.vaadin:vaadin / 25.1.0 - 25.1.13 / >=25.2.11 com.vaadin:vaadin / 25.2.0 - 25.2.10 / >=25.2.11 com.vaadin:vaadin / 25.3.0 - 25.3.2 / >=25.3.3 com.vaadin:vaadin-core / 14.14.0 - 14.14.7 / >=14.14.8 com.vaadin:vaadin-core / 23.6.0 - 23.6.16 / >=23.6.17 com.vaadin:vaadin-core / 24.4.0 - 24.4.25 / >=24.4.26 com.vaadin:vaadin-core / 24.5.0 - 24.5.15 / >=24.7.17 com.vaadin:vaadin-core / 24.6.0 - 24.6.13 / >=24.7.17 com.vaadin:vaadin-core / 24.7.0 - 24.7.16 / >=24.7.17 com.vaadin:vaadin-core / 24.8.0 - 24.8.17 / >=24.9.24 com.vaadin:vaadin-core / 24.9.0 - 24.9.23 / >=24.9.24 com.vaadin:vaadin-core / 24.10.0 - 24.10.11 / >=24.10.12 com.vaadin:vaadin-core / 25.0.0 - 25.0.13 / >=25.2.11 com.vaadin:vaadin-core / 25.1.0 - 25.1.13 / >=25.2.11 com.vaadin:vaadin-core / 25.2.0 - 25.2.10 / >=25.2.11 com.vaadin:vaadin-core / 25.3.0 - 25.3.2 / >=25.3.3 com.vaadin:flow-server / 2.13.0 - 2.13.7 / >=2.13.8 com.vaadin:flow-server / 23.6.0 - 23.6.15 / >=23.6.16 com.vaadin:flow-server / 24.4.0 - 24.4.18 / >=24.4.19 com.vaadin:flow-server / 24.5.0 - 24.5.17 / >=24.7.17 com.vaadin:flow-server / 24.6.0 - 24.6.14 / >=24.7.17 com.vaadin:flow-server / 24.7.0 - 24.7.15 / >=24.7.16 com.vaadin:flow-server / 24.8.0 - 24.8.16 / >=24.9.24 com.vaadin:flow-server / 24.9.0 - 24.9.28 / >=24.9.29 com.vaadin:flow-server / 24.10.0 - 24.10.14 / >=24.10.15 com.vaadin:flow-server / 25.0.0 - 25.0.15 / >=25.2.11 com.vaadin:flow-server / 25.1.0 - 25.1.18 / >=25.1.19 com.vaadin:flow-server / 25.2.0 - 25.2.12 / >=25.2.13 com.vaadin:flow-server / 25.3.0 - 25.3.3 / >=25.3.4 com.vaadin:vaadin-server / 7.1.0 - 7.7.54 / >=7.7.55 com.vaadin:vaadin-server / 8.0.0 - 8.32.1 / >=8.32.2 com.vaadin:vaadin-server-mpr-jakarta / 7.7.36 - 7.7.54 / >=7.7.55 com.vaadin:vaadin-server-mpr-jakarta / 8.18.0 - 8.32.1 / >=8.32.2

SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via Special:Search smw Profile

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup through the search parameter of the extended Special:Search profile. Attackers can send visitors crafted URLs using the smw profile with SVG event handlers, which ProfileForm::profile_sheet inserts unescaped into a pre element, executing script in the wiki origin.

SemanticMediaWiki 4.2.0 before 7.2.1 Reflected XSS via Special:FacetedSearch cstate

SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 csum or filtered=1, and cstate values that break out of hidden input attributes to execute script in victims' browsers.

Semantic MediaWiki 3.0.0 before 7.3.0 Missing Authorization via smwtask API

Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like smw.entityIdDisposer, and execute queued jobs, degrading performance and altering semantic data.

SemanticMediaWiki 2.5.0 before 7.3.1 Stored XSS via Special:Browse Code Property

SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject script through Code-typed property values. Attackers can annotate a valid JSON value embedding HTML markup, which the CodeStringValueFormatter renders unescaped on Special:Browse, executing JavaScript in viewers' sessions.

SemanticMediaWiki 3.2.0 before 7.3.1 Stored XSS via Special:Browse Group Heading

SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup through an unescaped property group schema canonical_name. Attackers can save a schema whose canonical_name holds script markup, which GroupFormatter renders unescaped in Special:Browse headings, executing JavaScript in viewers' sessions including administrators.

Semantic MediaWiki 3.0.0 before 7.3.1 Stored XSS via Special:Browse Keyword Property

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject HTML through Keyword-typed property values rendered unescaped on Special:Browse. Attackers can annotate a Keyword property with an event-handler payload that executes JavaScript in viewers' sessions, including administrators, to read tokens and perform actions.

Semantic MediaWiki before 7.3.1 Stored XSS via External Identifier in Special:Browse

Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject scripts via External identifier property values. Attackers can annotate markup payloads that ExternalIdentifierValue renders unescaped on Special:Browse, executing JavaScript in viewers' sessions, including administrators.

Semantic MediaWiki before 7.3.1 Reflected XSS via Special:SMWAdmin id Parameter

Semantic MediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in the Special:SMWAdmin ID lookup that allows unauthenticated attackers to inject markup through the unescaped id parameter. Attackers can lure an smw-admin administrator into opening a crafted lookup link, bypassing the auto-satisfied edit-token check, to execute script and perform privileged actions in the administrator's session.

SemanticMediaWiki 5.0.0 before 7.3.1 Stored XSS via Tooltip Module data-* Attributes

SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data-* attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span with a malicious data-content, data-title, data-top, data-bottom, or data-theme attribute to execute JavaScript when viewers, including administrators, hover it.

Semantic MediaWiki 3.1.0 before 7.3.1 Stored XSS via Schema Descriptions

Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement() in HtmlBuilder, altering pages and targeting users who view the schema.

Semantic MediaWiki 4.2.0 before 7.3.1 Stored XSS via FacetedSearch Exploration Labels

Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through FacetedSearch exploration-link labels. Attackers can store markup in the label, which ExploreListBuilder::buildHTML() passes unescaped to Html::rawElement(), altering the Special:FacetedSearch page and potentially running scripts in viewers' browsers.

Semantic MediaWiki 3.0.0 before 7.3.1 XSS via Property-Value Autocomplete

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site scripting vulnerability that allows attackers to inject markup by storing malicious semantic property values rendered unescaped in autocomplete suggestions. When another user opens the property-value autocomplete with an empty query, jquery.autocomplete.js concatenates the raw PValueLookup API value into HTML via container.html(), altering the dropdown and potentially executing script.

Semantic MediaWiki 3.0.0 before 7.3.1 CSRF via Special:SMWAdmin Maintenance Actions

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious page that triggers schema setup, entity-disposal, or job actions, causing semantic data loss and resource exhaustion.

Semantic MediaWiki 7.3.0 before 7.3.1 Missing Authorization via smwtask Update Task

Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask update task that allows users with edit rights to force semantic updates on arbitrary pages. Attackers can supply a serialized subject parameter for a restricted page to trigger forced reparsing, semantic-store writes, and resource-intensive dependency work.

Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via Special:PropertyLabelSimilarity

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows anonymous attackers to force quadratic computation by supplying a zero limit to Special:PropertyLabelSimilarity. Attackers can send repeated requests with limit=0 to bypass the SQL LIMIT and trigger pairwise similar_text() comparisons, exhausting PHP CPU, memory, and database connections.

Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via #set_recurring_event

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows low-privilege editors to bypass smwgMaxNumRecurringEvents by supplying a large limit parameter. Attackers can save pages using #set_recurring_event without an end date to generate thousands or millions of date subobjects, exhausting CPU, memory, and database resources.

Semantic MediaWiki 2.5.0 before 7.3.1 Missing Authorization via Is edit protected

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to permanently protect pages by adding an Is edit protected annotation. When $smwgEditProtectionRight is enabled, EditProtectionUpdater applies indefinite edit and move restrictions without checking the author's rights, locking other editors and administrators out.

SemanticMediaWiki 3.0.0 before 7.3.1 Reflected XSS via Special:Ask Separator Parameters

SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters (sep, propsep, valuesep, delim, separator) without HTML escaping in list, category, DSV, and CSV result printers. Unauthenticated attackers can send victims crafted Special:Ask links using request_type=raw or request_type=special_page to execute JavaScript in the wiki's origin, stealing sessions or CSRF tokens.