CVE Vulnerability Catalog

A protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network.

Cleartext transmission of sensitive information in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally.

A vulnerability in Windows Audio Service allows an authorized attacker to disclose sensitive information locally. The issue stems from improper access control to data.

A vulnerability in Windows File Explorer allows an authorized attacker to disclose sensitive information locally.

A security vulnerability was found in tamagui up to version 2.3.0, involving uncontrolled modification of object prototype attributes in the updateConfig function of config.ts. The attack can be performed remotely.

A path traversal vulnerability has been discovered in DedeCMS 5.7.118 in the ExtractFile function of include/zip.class.php, used in the Album Publishing Feature. Manipulation of the filename argument allows remote exploitation.

A vulnerability in Nexus Repository 3 allows a user with Capability Administration permission to send HTTP requests to internal network locations (SSRF). The lack of destination URL validation in the global webhook configuration enables an attacker to use the server to scan or attack internal systems.

Nexus Repository 3 is vulnerable to Server-Side Request Forgery (SSRF) via the SSL Certificate Retrieval endpoint. A user with the nexus:ssl-truststore:read permission can cause the server to initiate outbound connections to internal or restricted network hosts.

The password plugin in Roundcube Webmail before versions 1.6.17 and 1.7.2 was vulnerable to username spoofing via session data, which could lead to account takeover.

In Roundcube Webmail before version 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a TNEF attachment.

In Roundcube Webmail before version 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was vulnerable to a denial of service (DoS) attack via a crafted compressed-RTF size.

A cross-site scripting vulnerability in Hi.Events before 1.11.0 allows authenticated attackers with event creation or edit permissions to inject arbitrary HTML and JavaScript by embedding a malicious event title containing the </script> sequence, which is not escaped by JSON.stringify() when embedded in inline script tags. Attackers can craft an event title that breaks out of the script context in the application/ld+json structured data block or server-side rehydrated state, causing the payload to execute in the browser of any user who views the public event page, including unauthenticated visitors and authenticated administrators.

A vulnerability in Hi.Events before version 1.11.0 allows unauthenticated attackers to purchase hidden tickets by referencing their IDs in order creation requests due to missing server-side authorization checks. Attackers can enumerate sequential hidden ticket IDs from visible ones and buy VIP, invite-only, or discounted tickets not intended for public sale.

A buffer over-read vulnerability in Fortinet FortiOS and FortiProxy allows an attacker to disclose information by reading beyond the allocated buffer. This issue affects multiple versions of these products.

A path traversal vulnerability in FortiOS, FortiPAM, and FortiProxy allows an attacker to execute unauthorized code or commands by manipulating file paths.

A stack-based buffer overflow in Fortinet FortiOS, FortiPAM and FortiProxy may allow a privileged authenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands via crafted HTTP requests.

Pillow library versions 12.0.0 through 12.2.0 have a vulnerability in the EPS parser (PIL/EpsImagePlugin.py) that allows an infinite loop via a crafted EPS file with a negative byte count in the %%BeginBinary directive. An attacker can exploit this to cause a denial of service (DoS) when opening a malicious file with Image.open().

In Pillow library versions 5.2.0 through 12.3.0, a vulnerability exists in the TGA RLE encoder. When saving a mode 1 image with RLE compression, the encoder reads past its packed row buffer, causing adjacent process heap bytes to be copied into the generated TGA file. The issue is fixed in version 12.3.0.

A Cross-Site Scripting (XSS) vulnerability in FortiOS, FortiPAM, and FortiProxy allows an authenticated remote user to execute code or commands via crafted requests.

A vulnerability was found in spencermountain compromise up to version 14.15.1, where the nlp.extend function in src/API/extend.js allows improper modification of object prototype attributes. Remote exploitation is possible and a public exploit exists.