CVE Vulnerability Catalog

An information disclosure vulnerability in the local discovery mechanism of TP-Link Kasa EC70 v4 and EC71 v4 allows an unauthenticated attacker on the same local network to retrieve sensitive geolocation data through crafted responses.

An incorrect access control vulnerability in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Server v2.7.6 allows authenticated attackers with low-level privileges to cause a Denial of Service (DoS) by removing the license from the webserver.

A vulnerability was found in the zhinianboke xianyu-auto-reply server application in the file /api/v1/payment/withdraw/review?action=approve. An unknown functionality allows remote manipulation leading to trusting HTTP permission methods on the server side. The exploit has been publicly disclosed and may be used.

A security vulnerability was found in mastergo-design mastergo-magic-mcp up to version 0.2.0 in the execute function of the mastergo/component-workflow.md file of the mcp__getComponentGenerator component. Manipulation of the rootPath argument leads to path traversal, allowing access to files outside the intended directory. The attack requires local access, and the exploit has been publicly disclosed.

A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before version 1.4.0, in the interaction model command processing logic. Sending an InvokeCommandRequest to a nonexistent endpoint and cluster (e.g., 0x34) causes the code to incorrectly treat the endpoint as valid due to missing checks in CodegenDataModelProvider::Invoke, leading to a VerifyOrDie failure in ProcessCommandDataIB and a crash (SIGABRT). The issue has been acknowledged and fixed in a later revision (PR #37207).

A use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before version 1.4.0. The `GetDestinationGroupId().Value()` method is called without checking if a value exists, leading to a crash when an InvokeCommand is sent without initializing the destination group ID.

A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before version 1.4.0, affecting the ReadRevisionAttribute function used in multiple clusters (Channel, Account Login, TargetNavigator, etc.). The function lacks proper validation of the delegate pointer before dereferencing. A remote unauthenticated attacker can exploit this issue by sending a crafted read request, causing the device to crash (denial of service).

A reachable assertion vulnerability in Matter SDK (connectedhomeip) before 1.4.2 allows remote denial of service by sending a MoveToLevel command followed by writing OperationMode=2 in the Pump Configuration and Control cluster, causing a server crash.

Rclone before version 1.74.4 has a vulnerability in the archive extract function that allows extracted files to be written outside the user-selected destination directory when extracting a crafted archive containing parent path components (e.g., ../). This allows creation or overwrite of sibling objects in the same bucket or path scope.

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources without user interaction.

An Integer Overflow or Wraparound vulnerability in CAI Content Credentials could lead to a denial-of-service (DoS) condition. An attacker can exploit this flaw to crash the application without user interaction.

An Improper Input Validation vulnerability in CAI Content Credentials could lead to arbitrary file system read. An attacker can exploit this to access sensitive files and directories outside the intended scope. Exploitation requires user interaction, as a victim must open a malicious file.

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access without user interaction.

An Improper Input Validation vulnerability in CAI Content Credentials could lead to a denial-of-service (DoS) condition. An attacker can exploit this flaw remotely without user interaction, causing the application to crash.

CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

An Integer Underflow (Wrap or Wraparound) vulnerability in CAI Content Credentials could result in a denial-of-service (DoS) condition. An attacker can exploit this flaw to crash the application without user interaction.

A vulnerability in the Twig template engine before version 3.26.0 allows bypassing the sandbox mechanism. Several language constructs (conditional expressions, comparison operators, tests, template-loading tags, dynamic attribute names, spread arguments, the 'do' tag, and the '..' range operator) trigger string coercion on Stringable operands without checking SecurityPolicy::checkMethodAllowed().

In the Twig library (versions 3.0.0 through 3.26.0), the Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() and Profile::getName() into HTML output without escaping. This allows an attacker to inject arbitrary HTML via controlled template or profile names when a browser renders the profiler dump.

A vulnerability in the Twig template engine versions 3.24.0 through 3.26.0 causes object-destructuring assignment to compile CoreExtension::getAttribute() with the sandbox argument hardcoded to false. This disables property and method policy checks, allowing an attacker with write access to a sandboxed Twig template to read public properties or invoke public getters on objects passed to the template engine.

In the Twig library, a vulnerability was found where several filters in twig/markdown-extra and twig/cssinliner-extra are registered with is_safe => [all]. This causes Twig to treat plain text or HTML output as safe in HTML, JavaScript, CSS, URL, and other contexts where the output is not properly escaped. The issue is fixed in version 3.26.0.