CVE Vulnerability Catalog

A security vulnerability in alioshr memory-bank-mcp up to version 0.2.1/3.1 allows path traversal via the projectName argument in list-project-files-validation-factory.ts. Local access is required, and the exploit has been publicly disclosed.

A cross-site scripting vulnerability has been found in vnotex vnote up to version 3.20.1 in the YAML Frontmatter processing function within markdownit.js. Manipulation of the p_metaData argument allows remote script execution in the victim's browser.

In the Nuvoton NuMaker HSUSBD USB device-controller driver (udc_numaker.c), the control Data IN stage is unconditionally armed. When a USB host cancels an in-flight control transfer (timeout) and issues a new SETUP packet, the driver becomes out of sync, potentially sending stale data and permanently NAK'ing the control endpoint.

A vulnerability in FileBrowser before version 2.63.17 fails to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose new contents through the dormant public share URL.

Capgo before version 12.128.2 contains a SQL injection vulnerability in the POST /private/admin_stats endpoint. The limit parameter is destructured from an unvalidated request body and interpolated directly into Cloudflare Analytics Engine SQL queries via template literals.

A cross-site scripting vulnerability was found in the Attendance-Management-System by Akpali9 in the absent.php file. Manipulation of the export_date argument allows remote injection of malicious scripts. The product uses a rolling release model, so no specific version details are available.

ImageMagick before version 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.

In ImageMagick before version 7.1.2-26, there is a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures, causing a dangling pointer to reference freed memory, potentially leading to denial of service or code execution.

A vulnerability in ImageMagick before version 7.1.2-26 allows policy bypass in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by exploiting the APNG encoding process.

In ImageMagick before version 7.1.2-26, there is a heap use-after-free vulnerability caused by a missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes.

ImageMagick before versions 7.1.2-26 and 6.9.13-51 lacks a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the configured policy, resulting in a denial of service.

Parse Server versions >= 9.0.0, < 9.10.0-alpha.2 and <= 8.6.83 are affected by a stored XSS vulnerability. A malformed Content-Type (e.g., 'image//svg+xml') bypasses the file extension blocklist and is stored unchanged; on storage adapters like S3, GCS, or Azure, browsers fall back to MIME-sniffing and render HTML content, executing embedded scripts.

A heap buffer overflow vulnerability in ImageMagick before 7.1.2-19 in the magnify operation allows out-of-bounds memory read. An unrecognized magnify:method value triggers the issue, potentially exposing sensitive information or causing denial of service.

SSRF vulnerability in Drupal core allows an attacker to send requests from the server to internal network resources. The issue affects multiple Drupal versions including 10.5.x, 10.6.x, 11.2.x, 11.3.x, and older branches 11.0.x and 11.1.x.

Frappe framework prior to versions 16.18.3 and 15.108.0 had a vulnerability in the check_safe_sql_query function that allowed SELECT INTO OUTFILE queries. This could be exploited on self-hosted sites if database permissions are misconfigured and MySQL FILE privileges are available.

The AI (Artificial Intelligence) module for Drupal contains a missing authorization vulnerability that allows forceful browsing, enabling attackers to access unauthorized resources. Affected versions are from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, and from 1.4.0 to 1.4.3.

Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenAI Provider allows an attacker to send requests from the server to internal network resources. The issue affects versions from 0.0.0 to 1.1.1 and from 1.2.0 to 1.2.2.

An incorrect authorization vulnerability in the Drupal Advanced Content Feedback (admin_feedback) module allows forceful browsing, enabling unauthorized access to resources. Affected versions range from 0.0.0 to 2.8.0.

The Examples for Developers module for Drupal has a missing authorization vulnerability, allowing forceful browsing and unauthorized access to resources. This affects versions from 0.0.0 to 4.0.6.

A vulnerability in ZITADEL from version 4.0.0-rc.1 to 4.15.1 allows SSRF attacks due to inconsistent URL validation in HTTP notification channels, OIDC BackChannel logout, and SAML metadata URL fetches. Attackers can use DNS rebinding, redirects, or protocol downgrades to send requests to loopback, internal IP, or link-local endpoints.