CVE Vulnerability Catalog

Kernel software in a Guest/Host VM may send improper commands to GPU firmware, causing out-of-bounds writes. A logic error in address translation allows a compromised Host (Kernel) to perform arbitrary writes to firmware memory.

A SQL injection vulnerability was found in itsourcecode Content Management System 1.0 in the file /admin/add_sub_topic.php via the topic_id argument. The attack can be performed remotely, and the exploit is publicly available.

A SQL injection vulnerability was found in itsourcecode Content Management System 1.0 in the file /admin/update_ss_img.php via the topic_id argument. The attack can be performed remotely, and the exploit is publicly available.

A SQL injection vulnerability was found in itsourcecode Content Management System 1.0 in the file /save_comment.php via the Name argument. The attack can be performed remotely, and the exploit is publicly available.

Pharmacy Sales and Inventory System 1.0 has a vulnerability in the sell_statement function of application/controllers/ShowForm.php, leading to improper access controls.

A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. Affected is an unknown function of the file /admin/. This manipulation causes file and directory information exposure. The attack can be initiated remotely. The exploit has been published and may be used.

SSRF vulnerability in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet before 2.0.2-incubating allows attackers to send network requests to internal or restricted resources.

The PDBM application uses a static, hard-coded secret in the PDBM.exe executable. This secret is used for encryption, including decrypting credentials stored in the configuration file. Since the secret is constant across installations, an attacker with local privileges can extract it and decrypt the password, gaining administrative access to the PDBM management interface.

In Orca heat pumps, missing authentication and clear-text transmission to the server, combined with lack of input validation, can lead to stored XSS enabling cookie theft from the web interface.

A CSV injection vulnerability was found in Pharmacy Sales and Inventory System up to version 1.0. The issue occurs in the supplier creation interface where the Address/Company Name arguments are improperly handled. Remote exploitation is possible and the exploit is publicly available.

Stormshield Network Security versions 4.3.0-4.3.41, 4.8.0-4.8.15, and 5.0.0-5.0.5 have a Reflected XSS vulnerability in the login API. An attacker can execute a script on the victim's machine, potentially leading to cookie theft or redirection to malicious sites.

Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Brokers configured with a network connector with syncDurableSubs set to true are vulnerable to an unauthenticated attacker who can receive a list of all durable topic subscriptions in the broker, including client identifiers, subscription names, topic destinations, and JMS selector expressions, by sending a BrokerInfo command. The broker incorrectly responds without first ensuring the connection is authenticated.

In Apache Airflow, the EmailOperator and `airflow.utils.email` helpers establish SMTP STARTTLS connections without verifying the remote certificate when `smtp_starttls=True` and `smtp_ssl=False` are used. An attacker in a MITM position can present a self-signed certificate and capture SMTP credentials and message contents.

A bug in Apache Airflow's logout handling (FabAuthManager and KeycloakAuthManager) leaves previously-issued JWT tokens valid after logout, allowing an attacker to continue making authenticated API calls.

Apache Airflow before version 3.2.2 has a vulnerability in the GET /api/v2/eventLogs/{event_log_id} endpoint, which fetches audit log rows directly by numeric ID without per-Dag scoping. An authenticated user with audit log read permission for one Dag can read entries for other Dags by guessing or enumerating IDs.

Incomplete authorization in Apache ActiveMQ server before versions 6.2.6 and 5.19.7 allows authenticated connections to remove existing destinations with proper permissions.

In Apache Airflow, rendered template field handling caused bypass of nested sensitive key masking (e.g., password, token) when the field length exceeded the limit. An authenticated user with read permission could obtain plaintext secret values.

In Apache Airflow, the Variable response masker bypassed masking of nested sensitive keys (e.g., password, token) when the nesting depth exceeded the recursion limit. An authenticated user with read permission could obtain plaintext secret values.

A Cross-site Scripting vulnerability was found in Apache ActiveMQ and Apache ActiveMQ Web in the MessageServlet component. JMS message properties are copied into HTTP response headers without validation, allowing security header injection.

Apache Airflow before version 3.2.2 has a vulnerability in `JWTRefreshMiddleware` where the JWT cookie lacks the `Secure` flag. In deployments behind an HTTPS-terminating proxy, an attacker on the network (Wi-Fi MITM) can capture the cookie and replay it against the authenticated API.