CVE

We, Chainoptic, are striving harder to improve the cybersecurity for the local and global community. We strongly believe that identifying and eradicating cyber weaknesses on products will eventually make the internet a much safer to communicate and utilize. To accomplish our objective, we are pushing our best effort to investigate and identify security vulnerabilities on various types of software and hardware that are currently available on the internet. As a result of our enormous effort, our researchers were the first to identify and to report the following vulnerabilities.

See blog articles

Improper validation of specified hostname in VoiceTra

Case-Sensitive DNS Name Constraint Bypass in Go crypto/x509

Improper access control in Keycloak

Logic issue in WebKit potentially leading to Cross-site Scripting

Cookie Prefix Protection Bypass in Hono

Denial of Service (DoS) in EverShop

Server-Side Request Forgery (SSRF) in EverShop

Cross-site Request Forgery leading to Remote Code Execution in SOY CMS

Deserialization of untrusted data in XooNIps

Cross-site Scripting leading to Remote Code Execution in SOY CMS

Canonical Ubuntu apport Unnecessary Privileges Information Disclosure Vulnerability

Linux Kernel eBPF Improper Input Validation Vulnerability

Cross-site Scripting in Pi-hole

Server-side Request Forgery in Gitea

Stored Cross-site Scripting in GROWI

Stored Cross-site Scripting in KonaWiki3

Arbitrary File Read in KonaWiki3

Path Traversal in KonaWiki3

Cross-site Scripting in MarkText

Cross-site Scripting in PukiWiki

Cross-site Scripting in Zettlr

Cross-site Scripting in GROWI

OS Command Injection in Inkdrop

Denial of Service (DoS) in GROWI

Server-Side Request Forgery (SSRF) in Gogs

SQL Injection in Misskey

Deserialization of untrusted data in Dompdf

Cross-site request forgery in SvelteKit

Code injection in Enterprise Server

Incorrect Content-Type parsing in Fastify

Cross-site Scripting in

Remote code execution in Atlassian BitBucket

Cross-site Scripting in

Code Injection in Beekeeper Studio

Cross-site Scripting in Misskey

Cross-site Scripting in Joplin

Cross-site Scripting in Gipod

Cross-site Scripting in Kanboard

Arbitrary file write in Minecraft

Improper access control in Nextcloud guests app

Apache Answer: XSS vulnerability when changing personal website

Open redirect in Nextcloud

Content-Type allowlist bypass vulnerability in CarrierWave which possibly leads to XSS remained

Stored XSS in GROWI's event handlers

Stored Cross-Site Scripting (XSS) in GROWI App Settings (/admin/app), Markdown Settings (/admin/markdown), and Customization (/admin/customize)

Command injection in yt-dlp on Windows

Command injection in PHP on Windows

Command injection vulnerability in programing languages on Windows

Remote code execution in Werkzeug due to the improper CSRF protection

Remote code execution in VRCX

User enumeration in AquilaCMS

NoSQL injection in AquilaCMS

Cross-site Scripting to Remote Code Execution in BaserCMS

SQL Injection in XooNIps

Remote Code Execution in SOY CMS

Reflected Cross-site Scripting in XooNIps

Unauthenticated Remote Code Execution (RCE) in SOY CMS

Stored Cross-site Scripting in XooNIps

Cross-site Scripting in CMONOS.JP

Linux Kernel io_uring Use-After-Free Privilege Escalation Vulnerability

Linux Kernel Performance Counters Race Condition Privilege Escalation Vulnerability

Unauthenticated LFI to RCE in OneThird CMS

Linux Kernel setsockopt System Call Untrusted Pointer Dereference Information Disclosure Vulnerability

QEMU Plan 9 File System Time-Of-Check Time-Of-Use Privilege Escalation Vulnerability

Remote Code Execution in GROWI

Reflected Cross-site Scripting in KonaWiki3

Reflected Cross-site Scripting in Adminer

Linux Kernel eBPF Type Confusion Privilege Escalation Vulnerability

Arbitrary File Read/Delete in GROWI

Arbitrary File Read in GROWI

Remote Denial of Service (DoS) in ImageMagick

Linux Kernel Bluetooth CMTP Module Double Free Privilege Escalation Vulnerability

Canonical Ubuntu eBPF Out-Of-Bounds Access Privilege Escalation Vulnerability

Improper Access Control leading to Information Leakage in GROWI

Server-Side Request Forgery (SSRF) vulnerability in Kallithea

Stored Cross-site Scripting in Kallithea

Remote Code Execution in PukiWiki

Server-Side Request Forgery (SSRF) vulnerability in git

Open redirect in

Cross-site Scripting in Misskey

Datadog access token leakage in

Typora fails to properly neutralize JavaScript code

Cross-site Scripting in RSSHub

Cross-site Scripting in Misskey

Path Traversal in Go

Cross-site Scripting in Discourse

Improper Access Control for browser APIs in Obsidian

Cross-site Scripting in Dokuwiki

Arbitrary file write in Git

Cross-site Scripting in Joplin

Cross-Site Request Forgery in GROWI User Settings Page (/me)

Stored Cross-Site Scripting (XSS) via img Tags in GROWI

Stored Cross-Site Scripting (XSS) in GROWI Security Settings (/admin/security)

Cross-site scripting in Collabora Online

Arbitrary file write in JGit

Improper Authorization in GROWI User Management (/admin/users)

Authentication bypass in Nextcloud Global Site Selector

Improper access control in Nextcloud guests app

Authorization header leakage on same-domain but cross-origin redirect in scrapy/scrapy

Plaintext Display of Secret Access Key in GROWI App Settings (/admin/app)

Content-Type allowlist bypass vulnerability in CarrierWave, possibly leading to XSS

Permission prompt spoofing in Deno

Insufficient escaping in html/template of Go

Cross-site scripting in ArgoCD

Cross-site scripting in RSSHub

Command injection in Rust on Windows

Cross-site scripting in Jinja

Remote code execution in XSOverlay

Remote code execution in Nuxt

Denial of service in Discourse

NoSQL injection in Adapt Authoring Tool

Stack-based buffer overflow in WAB-I1750-PS/WAB-S1167-PS

Cross-site scripting in WAB-I1750-PS/WAB-S1167-PS

Inefficient Regular Expression Complexity issue in wiki impacts CE/EE

Incorrect Privilege Assignment issue in delete issues operation impacts CE/EE

Incorrect access control in Adapt Authoring Tool

Path traversal in Papermark

Guest user can read Security policy YAML in -EE