CVE Vulnerability Catalog

RabbitMQ before versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6 allows foreign bindings to amq.rabbitmq.reply-to destinations. The vulnerability is due to missing deletion checks for volatile direct-reply-to queues in Khepri, leaving persistent route entries after unbind.

RabbitMQ before versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5 has a vulnerability in the rabbitmq_management HTTP API that accepts oversized valid JSON bodies on with_decode and direct_request paths. The issue is due to incorrect size checking in read_complete_body, which checks the size before the final chunk but not the final combined size.

A vulnerability in OpenReplay allows an authenticated low-privilege user to read the first 15 seconds of session replay data from another tenant. The issue stems from missing validation that the session belongs to the project when generating presigned download URLs.

In OpenReplay versions 1.27.0 and earlier, three mutation functions (notes.delete, dashboards.update_widget, dashboards.remove_widget) did not check resource ownership, allowing any authenticated user to delete other users' private session notes and modify widgets on their private dashboards.

Grist prior to version 1.7.15 contained two cross-site scripting vulnerabilities where an attacker-controlled value reached a link's href without scheme validation, allowing JavaScript execution in the victim's context on a single click. On the account-selection page, the next parameter was used as the link target, and in document tours, the GristDocTour table's Link_URL column became a clickable button, enabling an editor to store a malicious URL.

Grist is spreadsheet software using Python as its formula language. Prior to version 1.7.15, several server-rendered pages embedded user-controlled values without proper escaping, leading to cross-site scripting. On the main page, a document's name or description set by an editor is rendered for other users. On the OAuth2 end-of-flow page, the openerOrigin parameter is reflected back.

A vulnerability in the LangChain4j Java library allows SQL injection via crafted metadata keys in queries to MariaDB and pgvector databases. Insufficient escaping enables arbitrary SQL execution, leading to data exfiltration, denial of service, or row deletion.

In OpenResty from version 1.29.2.1 to before 1.29.2.5, an out-of-bounds write vulnerability exists in the upstream PROXY protocol v2 implementation. An attacker can cause the worker process to crash, leading to a denial of service (DoS). Only configurations with explicitly enabled PROXY protocol v2 for upstream connections are affected.

A vulnerability in Gotenberg prior to version 8.34.0 allows blind SSRF and limited local file disclosure via a specially crafted document sent to the /forms/libreoffice/convert endpoint. LibreOffice automatically retrieves external HTTP(S) resources and local files during document conversion.

A vulnerability in the h2o HTTP server prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1 causes a crash when processing QPACK instructions over HTTP/3. The function in lib/http3/qpack.c allocates an on-stack buffer of approximately 800 KB using alloca, exceeding the default pthread stack size in musl libc and leading to a segmentation fault.

A vulnerability in kernel software running inside a Host VM allows sending improper commands to GPU firmware, potentially causing a memory write outside the allowed range for the host kernel. Additionally, a TOCTOU bug exists where a malicious driver can modify values in memory after firmware validation but before use.

A vulnerability in kernel software running inside a Host VM allows sending improper commands to GPU firmware, leading to unauthorized GPU register access and privilege escalation.

A vulnerability in the sparse memory implementation of GPU drivers allows out-of-bounds (OOB) kernel memory reads or writes. The flaw occurs when indexing pages larger than 4 kB in the page freeing logic, leading to incorrect buffer access.

A vulnerability in GPU software allows a non-privileged user to perform improper GPU system calls, causing an integer overflow and mapping two GPU virtual addresses to the same physical address. After one virtual mapping is freed, the physical page can be reallocated, and the second mapping enables access to freed memory (use-after-free).

RustDesk before version 1.4.9 does not enforce the authorized connection scope of a session on the server side. An authenticated remote peer with a limited session type (FileTransfer, PortForward, ViewCamera, or Terminal) can send control messages and login options reserved for a full Remote session.

In FreeRDP prior to version 3.27.1, when using the /cache:codec:rfx option, clients pass incorrect dimensions to RemoteFX decoding, allowing a malicious RDP server to trigger a heap out-of-bounds write with attacker-controlled offset and content.

Logto before version 1.41.0 has an XML injection vulnerability in SAML, where user-controlled profile attributes (e.g., name, email) are substituted into a SAML template without proper escaping. An authenticated low-privilege user can inject XML markup into a profile attribute, forging SAML attributes like role, leading to privilege escalation in relying service providers.

Snipe-IT prior to version 8.6.2 has a vulnerability due to insufficient sanitization of uploaded SVG files. A low-privilege user can upload active XHTML or XML content that is later served same-origin and executes JavaScript in a viewer's browser.

Snipe-IT prior to 8.5.0 stores the User-Agent header from requests in the action log and writes it to the Activity Report CSV without formula escaping. This allows a low-privileged authenticated user to inject a malicious formula that may execute when the CSV is opened in spreadsheet software.

Logto prior to version 1.41.0 has a vulnerability in the step-up verification mechanism in Account Center. An attacker with an API token can create and verify a WebAuthn registration for a new passkey, then use it as identity verification, allowing MFA factor management without possessing a password, identifier, or existing MFA factor.