CVE Vulnerability Catalog

The KernCoreLib64.sys kernel driver in MSI Feature Manager has a local privilege escalation vulnerability. Any locally logged-on user can perform arbitrary physical memory read/write and unrestricted I/O port operations via exposed IOCTL handlers.

Vtiger CRM up to version 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature. An administrator can upload a crafted ZIP archive that extracts arbitrary PHP files into the modules/ directory under the web root without validating file types beyond manifest.xml.

Vtiger CRM before version 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .phar file with arbitrary PHP code via the Documents module. The vulnerability is due to the omission of the .phar extension from the denylist in config.inc.php and a misconfigured .htaccess file that is silently ignored on Apache 2.4 deployments.

A weak password recovery mechanism for forgotten passwords exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux, and Kubernetes. A remote, unauthorized attacker may assume ownership of a user's account by manipulating this mechanism.

A vulnerability in the Phoenix JavaScript presence client (Presence module) involves an improper existence check using a bare truthiness test (state[key]) instead of an own-property check. An attacker with ordinary channel access can choose a presence key that is an Object.prototype member name (e.g., __proto__, constructor, toString), causing the lookup to return the built-in prototype object and throw an uncaught TypeError. The flaw resides in assets/js/phoenix/presence.js in Presence.syncState and Presence.syncDiff and affects phoenix versions from 1.2.0-rc.0 before 1.5.15, from 1.6.0-rc.0 before 1.6.17, from 1.7.0-rc.0 before 1.7.24, and from 1.8.0-rc.0 before 1.8.9.

A vulnerability in the Phoenix.Socket module of the Phoenix framework allows an unauthenticated attacker to perform a DoS attack by sending a large number of phx_join messages over a single WebSocket or LongPoll connection. This exhausts the BEAM virtual machine process limit, blocking legitimate traffic across the entire node.

The AMP for WP – Accelerated Mobile Pages plugin for WordPress up to version 1.1.12 contains an arbitrary file write vulnerability. It is due to unsafe ZIP extraction in the ampforwp_save_local_font() function and inadequate cleanup that fails to remove nested directories and files.

Dell PowerProtect Data Domain products in multiple versions contain an OS command injection vulnerability. This flaw allows a remote high-privileged attacker to bypass protection mechanisms.

A vulnerability in Fleet allows an attacker with git push access to overwrite Pod Security Standards (PSS) enforcement labels on a target namespace. This occurs because the agent-side deployer does not filter security-sensitive keys from namespaceLabels in fleet.yaml.

An LDAP injection vulnerability in HAVELSAN Inc. Liman MYS allows an attacker to manipulate LDAP queries due to improper neutralization of special elements. The issue affects versions before release.Master.1107.

An improper verification of cryptographic signature vulnerability in HAVELSAN Inc. Liman MYS allows fake the source of data. This issue affects Liman MYS versions before release.Master.1107.

A missing authorization vulnerability in HAVELSAN Inc. Liman MYS allows accessing functionality not properly constrained by ACLs. This issue affects versions before release.Master.1107.

A path traversal vulnerability was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.

A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). An authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that overflows a 512-byte heap receive buffer without bounds checking, causing a denial of service (server crash).

A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() causes an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

Missing Authorization vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (GKS) allows collecting data from common resource locations. This issue affects versions before 2.0.

An authorization bypass vulnerability in Ontime through a user-controlled key allows exploitation of trusted identifiers. Affects versions up to 04052026.

An authorization bypass vulnerability in Ontime allows exploitation of trusted identifiers through a user-controlled key. The issue affects versions up to 04052026.

Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files. This issue affects MicroRealEstate through version 1.0.0-alpha3.