CVE Vulnerability Catalog

In westboy CicadasCMS up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab, the Search function in org/springframework/cache/support/AbstractCacheManager.java is vulnerable to cross-site scripting (XSS) via the s argument. Remote exploitation is possible and the exploit is public.

Vulnerability in lin-cms-spring-boot (TaleLin) up to version 0.2.1 allows improper access controls through manipulation in the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java, affecting the book Endpoint component.

In Edimax BR-6478AC 1.23, the formStaDrvSetup function in /goform/formStaDrvSetup is vulnerable to command injection via the rootAPmac argument. The attack can be performed remotely, and the exploit is publicly available.

A vulnerability was found in the Text::LineFold module for Perl (part of the Unicode-LineBreak distribution). The module splits the input string into segments based on special line break characters but applies the break function to the entire string, not just the segment. This causes output duplication for each segment, potentially leading to excessive resource consumption and denial of service.

A buffer overflow vulnerability in Arm Whois 3.11 allows local attackers to crash the application by supplying an oversized input string. Attackers can paste a malicious buffer of 700 bytes into the IP address or domain input field to trigger a denial of service.

Open STA Manager 2.3 contains a path traversal vulnerability that allows authenticated users to download arbitrary files by manipulating the file parameter. Attackers can send GET requests to modules/backup/actions.php with op=getfile and traverse directories using ../ sequences to access sensitive system files.

In Open5GS up to version 2.7.7, a denial of service vulnerability exists in the ogs_pool_id_calloc function in /lib/sbi/nghttp2-server.c. The attack can be launched remotely and the exploit has been made public.

A vulnerability in Open5GS up to version 2.7.7 in the function ogs_sbi_xact_add in the library /lib/core/ogs-timer.c (ue-authentications Endpoint) allows denial of service (DoS) via manipulation. The attack can be performed remotely, and the exploit is publicly available.

Open5GS up to version 2.7.7 has a vulnerability in the library lib/sbi/nnrf-handler.c (Shared NF-profile Parser component), leading to denial of service.

In Open5GS up to version 2.7.7, the handle_scp_info function in lib/sbi/nnrf-handler.c of the Shared NF-profile Parser component causes an out-of-bounds write. Remote exploitation is possible and the exploit is public.

In the lib/sbi/nnrf-handler.c library in Open5GS up to version 2.7.7, there is a DoS vulnerability through manipulation of the Shared NF-profile Parser. The attack can be launched remotely, and the exploit is publicly available.

The SocketCAN implementation validates the length of a user-provided buffer containing a socketcan_frame object using only a NET_ASSERT statement in zcan_sendto_ctx() before dereferencing it in socketcan_to_can_frame(). In production builds where assertions are disabled, a userspace application that controls the length passed to a sendto syscall can supply an incomplete or truncated frame, causing socketcan_to_can_frame() to dereference fields beyond the end of the buffer. This results in an out-of-bounds read that can cause denial-of-service crashes or, because the parsed frame contents are transmitted on the network, leak adjacent memory.

Exim 4.88 before 4.99.4 in some proxy configurations mishandles short payloads, disclosing uninitialized stack memory values to a client.

A race condition in the shared Extreme Platform ONE IAM Gateway API-key authentication path could, under high-concurrency traffic, intermittently allow requests authenticated with one tenant's API key to receive response data for another tenant. The issue was observed through ExtremeCloud IQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE /Common Services API paths; XIQ-native tokens and standard OAuth/Bearer JWT authentication were not affected.

FreeScout prior to 1.8.221 allows a non-admin user to permanently delete an internal note from any conversation, even after access to the mailbox has been revoked, due to missing mailbox membership check in ThreadPolicy::delete. Fixed in 1.8.221.

FreeScout prior to 1.8.221 has a missing mailbox membership check in ThreadPolicy::edit, allowing a user with PERM_EDIT_CONVERSATIONS to rewrite thread content after being removed from the mailbox. Fixed in 1.8.221.

cpp-httplib prior to 0.43.4 has a vulnerability related to negative chunk-size in chunked Transfer-Encoding. The ChunkedDecoder::read_payload function parses the chunk-size field using std::strtoul(), which accepts a leading minus sign, causing unsigned wrap-around. The library only rejects -1, but other negative values like -2 pass validation, leading to unbounded memory allocation and process crash.

FreeScout prior to version 1.8.219 has a vulnerability in the password reset endpoint that returns visually distinct responses depending on whether the submitted email address belongs to an existing user account. This allows unauthenticated attackers to enumerate valid helpdesk agent email addresses.

The brace-expansion library versions 5.0.0 to before 5.0.6 apply the max option too late, causing excessive memory (~505 MB) and CPU (~800 ms) usage when expanding large numeric ranges. Fixed in version 5.0.6.

NanoMQ MQTT Broker before version 0.24.14 has a type confusion vulnerability during dialer close. This leads to incorrect object interpretation and may cause hang or crash.