CVE Vulnerability Catalog

An out-of-bounds heap write vulnerability exists in the RAR5 recovery-volume (.rev) parser of WinRAR and UnRAR. The RecItems vector is sized only when the first .rev file is processed, and subsequent files can supply a RecNum value validated only against their own TotalCount field, not against the actual vector size. A crafted set of .rev files allows writing a controlled 32-bit value (RevCRC) past the allocated buffer, corrupting adjacent heap objects.

The CRI plugin in containerd prior to versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may allow arbitrary command execution on the host via a plugin that consumes container labels for operations.

A denial-of-service (DoS) vulnerability was found in the Oj (Optimized JSON) library for Ruby. The Oj::Doc#each_child function, when recursively processing a deeply nested JSON document, overflows a fixed-size stack buffer, causing a process crash. The issue has been fixed in version 3.17.3.

phpMyFAQ before version 4.1.5 contains a privilege escalation vulnerability in GroupController::updatePermissions that allows GROUP_EDIT administrators to grant arbitrary rights to groups without verifying they hold those rights themselves. A delegated administrator can exploit this by assigning high-value permissions to a group they belong to, inheriting those rights and escalating privileges up to full administrative control.

An authorization flaw in Capgo before version 12.128.2 in the POST /private/create_device endpoint allows an authenticated attacker to create device records for an application using a foreign organization identifier. The lack of validation of the org_id parameter bypasses the intended org/app authorization boundary.

A vulnerability in Capgo before version 12.128.2 allows unauthenticated attackers to use the RPC functions get_user_id and get_org_perm_for_apikey to validate API keys and disclose user UUIDs. Using the public API key, attackers can verify leaked keys, enumerate users and apps, and determine permission levels.

An authentication bypass vulnerability in Capgo before version 12.128.2 allows account deletion without password re-authentication or secondary verification. Attackers can delete user accounts via session hijacking, CSRF attacks, or parameter tampering, leading to unauthorized account deletion, data loss, and denial-of-service.

Crawl4AI before version 0.8.7 contains an arbitrary JavaScript execution vulnerability in the /execute_js endpoint of the Docker API server. An attacker can submit malicious scripts that execute in the server's browser context with disabled web security.

An authorization bypass vulnerability in Capgo before version 12.128.2 allows authenticated users to overwrite existing channels by reusing their names. Attackers with app.create_channel permission can exploit a logic mismatch between existence validation and upsert operations.

A vulnerability in Capgo before version 12.128.2 allows org admins to assign org-scoped RBAC roles at app scope without validating role scope compatibility, including to pending invitees. Attackers can pre-seed malformed high-privilege bindings that survive invite acceptance, enabling accepted low-privilege users to perform unauthorized privileged app actions.

Capgo before version 12.128.2 contains a path traversal vulnerability in the builder upload proxy that allows authenticated users with build permissions to bypass upload restrictions. Attackers can append traversal sequences to the upload path, which are normalized by the WHATWG URL parser, enabling access to internal administrative endpoints with the privileged BUILDER_API_KEY header and resulting in server-side privilege escalation.

The vulnerability in Capgo before version 12.128.2 is a broken object level authorization in the middlewareKey() function. It accepts the client-controlled x-limited-key-id header without validating ownership, allowing authenticated users to adopt cross-tenant limited keys. Attackers can supply another tenant's limited key ID to bypass authorization checks and access unauthorized cross-tenant resources across multiple API endpoints.

A vulnerability in Capgo before version 12.128.2 allows unauthenticated attackers to bypass authorization in the public.get_org_user_access_rbac function. By exploiting improper NULL comparison in the authorization gate, attackers can disclose RBAC role bindings and member email addresses using only a public API key.

A vulnerability in electron-updater prior to 26.15.0 allows an empty path component in the LD_LIBRARY_PATH environment variable, adding the current working directory to the dynamic linker search path. An attacker can execute arbitrary code by placing a malicious shared library in the directory from which the AppImage is launched.

A buffer overflow vulnerability has been discovered in the UTT nv518G device running firmware version nv518GV3v3.2.7-210919-161313. A remote attacker can exploit the gohead/sub_425994 component to cause a denial of service (DoS).

A vulnerability in the UTT nv518G router running firmware version nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service (DoS) via the gohead/sub_44af70 component.

A buffer overflow vulnerability has been discovered in the UTT nv518G device running firmware version nv518GV3v3.2.7-210919-161313. A remote attacker can exploit this flaw in the gohead/sub_472f08 component to cause a denial of service (DoS).

A buffer overflow vulnerability has been found in the UTT nv518G device running firmware version nv518GV3v3.2.7-210919-161313. A remote attacker can exploit the gohead/sub_447CAC component to cause a denial of service (DoS).

Inappropriate implementation in AI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

A Use-After-Free vulnerability in the Audio component of Google Chrome on Linux prior to version 150.0.7871.47 allows a remote attacker to execute arbitrary code via a crafted HTML page. The issue is rated as Low severity by the Chromium security team.