CVE Vulnerability Catalog

libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur.

A vulnerability in NetworkManager allows local privilege escalation through processing malformed MUD URLs in the dhclient backend. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL, provided an administrator has explicitly configured NetworkManager to use dhclient. This issue does not affect default configurations of NetworkManager.

OpenStack Ironic before version 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.

OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template.

OMICARD EDM by ITPison has an Insecure Direct Object Reference vulnerability, allowing unauthenticated remote attackers to modify a specific parameter to obtain user's email address.

The MasterStudy LMS Pro Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'columns' parameter in all versions up to, and including, 4.8.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with instructor-level access or above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Out-of-bounds read vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink software before 2.11.12. An unauthenticated attacker within radio range can disclose a small amount of kernel heap memory or cause DoS (kernel oops/panic) via a crafted 802.11ah beacon or probe response with a malformed Vendor Information Element. The function morse_vendor_find_vendor_ie() does not validate IE length, leading to an out-of-bounds read of up to 9 bytes. No authentication or user interaction required.

The Perl library Net::Async::Statsd::Client up to version 0.005 does not validate metric names for newlines, colons or pipes. This allows injection of additional statsd metrics when data comes from untrusted sources.

OpenStack Ironic before 35.0.2 allows iPXE script injection if the attacker can set node.driver_info or node.instance_info.

FOSSBilling before 0.8.0 has an open redirect vulnerability in the Redirect module. The module does not validate the URL scheme of administrator-configured destination URLs, allowing arbitrary external URLs as redirect targets.

FOSSBilling prior to version 0.8.0 leaks the exact system version through asset cache buster parameters in HTML output, bypassing the hide_version_public security setting.

Cross-Site Scripting vulnerability in MaxSite CMS v.109.2 allows a remote attacker to obtain sensitive information via the Backend page file upload endpoint used by admin_page.

A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reachable via xls_parseWorkBook() and is triggered by uninitialized heap memory originating from the OLE layer (ole2_read). The flaw is detectable with MemorySanitizer (MSAN) and can lead to undefined behavior, incorrect parsing logic, or potential information disclosure.

libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table (MSAT) in read_MSAT() is not fully initialized before being consumed by ole2_validate_sector_chain(), which may result in application crashes or potential information disclosure when processing a crafted XLS file.

A type confusion vulnerability exists in OP-TEE OS when processing an FFA_MEM_SHARE request from the normal world, affecting versions 4.3.0 through 4.11.0. This only applies when configured as an SPMC for S-EL0 SPs.

OP-TEE before version 4.11.0 does not verify that an ECDH public key lies on the correct curve. An attacker in the normal world can send about 30-40 crafted public keys to reconstruct the private key.

An authenticated user can persist arbitrary HTML/JavaScript in the email_id or mobile_no fields of a Customer record and trigger unescaped rendering in the Point of Sale (POS) interface for every operator who selects that customer. This affects ERPNext version 16.16.0.

ERPNext 16.16.0 allows authenticated users with Item edit permissions to inject arbitrary HTML/JavaScript into item_name, description, or image fields. This code is rendered unescaped in the POS cart interface for every operator adding that item.

Koha versions up to 25.11 contain a Server-Side Request Forgery (SSRF) vulnerability in the Z39.50/SRU server configuration. Authenticated attackers can scan internal networks and identify running services by analyzing server response times.

Koha version 25.11 and earlier is vulnerable to XSS via the file upload function in the Invoice module. An attacker can remotely execute arbitrary JavaScript code.