CVE Vulnerability Catalog

Ghidra versions 10.2 through 12.0 contain an uncontrolled resource consumption vulnerability in ExportTrie.parseTrie() lacking cycle detection when processing Mach-O export tries. A crafted Mach-O binary with circular references causes unbounded queue growth and exponential string concatenation, leading to OutOfMemoryError and JVM crash.

Debusine is an integrated solution to build, distribute, and maintain a Debian-based distribution. The parser used to read manifest files accepted arbitrary fully user-controlled paths, potentially allowing the creation of arbitrary symbolic links on a worker.

Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Endpoints that create and delete relationships between artifacts enforced no permissions checks beyond being able to see the artifacts in question.

Stored Cross-Site Scripting (XSS) vulnerability in the Easy Image Collage plugin for WordPress up to version 1.13.6. The issue is due to insufficient input sanitization and output escaping in the 'grid[properties][borderColor]' and 'grid[images][N][attachment_url]' parameters. Authenticated attackers with author-level access and above can inject arbitrary scripts, and unfiltered_html restrictions do not apply because data is stored via update_post_meta().

Stored Cross-Site Scripting (XSS) vulnerability in the MW WP Form plugin for WordPress up to version 5.1.3. The issue is due to insufficient input sanitization and output escaping in the 'memo' parameter. Authenticated attackers with editor-level access and above can inject arbitrary scripts, and WordPress's built-in kses and unfiltered_html protections do not apply because data is stored via update_post_meta().

Stored Cross-Site Scripting (XSS) vulnerability in the aThemes Addons for Elementor plugin for WordPress up to version 1.1.8. The issue is due to insufficient input sanitization and output escaping in the 'title_tag' widget setting. Authenticated attackers with contributor-level access and above can inject arbitrary scripts. This affects the Posts Timeline and Posts Carousel widgets (including Default, Banner, and Modern skins), which omit the whitelist validation.

Vulnerability in Dahua products allows an authenticated remote attacker to send a crafted packet, causing an exception and unexpected system reboot, leading to denial of service.

An attacker who intercepts and tampers with traffic between the client application and the API Gateway server could potentially deserialize arbitrary objects. This vulnerability could lead to broken security expectations or remote code execution.

The Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via multiple parameters in all versions up to and including 4.2.6 due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

File Station 6 has a resource allocation without limits vulnerability. A remote attacker who gains a user account can exploit it to prevent other systems, applications, or processes from accessing the same type of resource.

A path traversal vulnerability has been reported in several QNAP operating system versions. A remote attacker with an administrator account can read unexpected files or system data.

File Station 6 has a NULL pointer dereference vulnerability. A remote attacker who gains a user account can exploit it to launch a denial-of-service (DoS) attack.

License Center prior to version 1.9.56 contains a path traversal vulnerability. A local attacker with an administrator account can read the contents of unexpected files or system data.

ESF-IDF (Espressif IoT Development Framework) versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0 contain an out-of-bounds read vulnerability in the BlueDroid AVRCP vendor-command parser (avrc_pars_vendor_cmd). Patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.4, and 6.0.1.

ESP-IDF (Espressif IoT Development Framework) has an out-of-bounds read vulnerability in the DHCP server option parser in the lwIP component. A crafted DHCP request can cause reads past the buffer into adjacent heap memory.

Frappe Learning Management System (LMS) prior to version 2.53.0 allows an authenticated user to supply specially crafted content in certain user-editable fields. When surfaced in page metadata, this causes visitors' browsers to navigate to an attacker-chosen URL.

BuddyPress 14.4.0 has an IDOR vulnerability in the friends REST API allowing an authenticated attacker to enumerate any user's complete friend list. The get_items_permissions_check method only checks if the requester is logged in, not ownership.

The SubjectDnX509PrincipalExtractor in Spring Security does not correctly handle certain malformed X.509 certificate CN values, potentially reading the wrong username. A crafted certificate could allow an attacker to impersonate another user. Affected versions: 5.7.0-5.7.24, 5.8.0-5.8.26, 6.3.0-6.3.17, 6.4.0-6.4.17, 6.5.0-6.5.10.

In Nimiq prior to version 1.5.0, a remote peer can crash any full node by sending a RequestBatchSet message containing the genesis block's hash. The handler calls get_epoch_chunks which iterates backwards through macro blocks and panics when reaching the genesis block number.

In Nimiq (Rust implementation of Nimiq Proof-of-Stake protocol) before version 1.4.0, a denial-of-service vulnerability exists in the Ed25519 multisig delinearization code. An invalid public key can cause a panic and crash the process. Fixed in version 1.4.0.