CVE Vulnerability Catalog

ImageMagick before versions 6.9.13-48 and 7.1.2-23 contains a heap buffer over-read vulnerability in the server process of the magick -distribute-cache service. Attackers who can connect to this service can exploit it.

In ImageMagick prior to versions 6.9.13-48 and 7.1.2-23, the distributed pixel cache operated without a challenge–response authentication model. This has been changed in newer versions.

ImageMagick prior to versions 6.9.13-48 and 7.1.2-23 contains a race condition vulnerability that allows an attacker connected to the magick -distribute-cache service to hijack a file descriptor in the server process.

ImageMagick before versions 6.9.13-48 and 7.1.2-23 contains a heap buffer over-write vulnerability in the server process of the magick -distribute-cache service. Attackers who can connect to this service can exploit it.

SQLAdmin before version 0.25.1 has a vulnerability in the ajax_lookup endpoint that bypasses the is_accessible() access control check. An authenticated user can query model data through this endpoint even if a developer restricted access by overriding is_accessible().

In ImageMagick, a vulnerability was found in JP2 handling where an incorrect check leads to a heap buffer over-write of a single byte when certain options are specified. The issue affects versions prior to 6.9.13-48 and 7.1.2-23.

In ImageMagick, a vulnerability was found in the fx operation where a missing depth check can lead to a stack overflow when a crafted argument is passed. The issue affects versions prior to 7.1.2-23.

In ImageMagick prior to versions 6.9.13-48 and 7.1.2-23, when using LZMA compression in the MIFF encoder an out-of-bounds write can occur due to a missing check. This issue has been fixed in versions 6.9.13-48 and 7.1.2-23.

An LDAP injection vulnerability exists in the Yamcs mission control framework within the `LdapAuthModule` class. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping, allowing an attacker to manipulate LDAP queries.

Improper input validation for DIMM SPD metadata could allow an attacker with physical access, ring0 access, or control over the Root of Trust for BIOS update to overwrite guest memory, resulting in loss of guest data integrity.

Simple Link Directory through 9.0.4 echoes embed shortcode attributes into HTML data attributes without escaping in the embedder template. Attackers with contributor access can inject an event handler executing in a viewer's browser.

Simple Link Directory through 9.0.4 interpolates the sld_no_results_found option into a JavaScript string literal without encoding. Because sanitize_text_field leaves quotes intact, a stored payload breaks out of the string and runs script for every page visitor.

Yoast Duplicate Post through 4.6 inserts an unescaped post title and permalink into the Classic Editor scheduled republish notice. Attackers can schedule a republish copy with a crafted title to execute script when an administrator views the resulting notice.

A Cross-Site Request Forgery (CSRF) vulnerability was found in the Yoast Duplicate Post plugin up to version 4.6 in the duplicate_post_dismiss_notice handler. Lack of nonce or capability verification allows an attacker to trick an authenticated user into sending a request that sets the duplicate_post_show_notice option, suppressing admin notices network-wide.

Juicer through 1.12.18 fails to escape remote feed API response fields before rendering on the admin settings page. Attackers controlling feed data can inject scripts that execute in the administrator's browser.

A Cross-Site Request Forgery (CSRF) vulnerability was found in the Easy Twitter Feeds plugin before version 1.2.13 in the duplicate_post action handler. Lack of nonce verification allows an attacker to trick an authenticated user into visiting a crafted link that duplicates any post regardless of post type.

Sharp, a Laravel content management framework, from version 9.0.0 to before 9.22.3 does not enforce authorization checks on the create and store endpoints of the Quick Creation Command feature. An authenticated Sharp user without create permission on a given entity can bypass authorization and create new records for that entity if a Quick Creation Command handler is configured.

Russh before version 0.61.0 does not strictly enforce SSH identification-string rules. The server-side identification reader uses a permissive path, allowing pre-banner lines from clients and not bounding their number. A remote attacker can hold connection setup resources in the cleartext pre-authentication phase with malformed identification input.

Russh (Rust SSH client & server library) versions 0.37.0 through 0.61.0 contain a vulnerability in the keyboard-interactive authentication path. A malicious SSH server can send USERAUTH_INFO_REQUEST with a controlled prompt count, and the client uses that count directly in Vec::with_capacity(...) before validation, potentially causing memory issues.

Russh before version 0.61.0 has a vulnerability in the server authentication path where internal authentication state is not reset when the username or service changes between requests. This can affect later requests for a different (user, service).