CVE Vulnerability Catalog

In pam_usb prior to 0.9.1, src/evdev.c silently ignores EACCES errors when opening /dev/input/event* nodes, causing pusb_has_virtual_input_device() to return 0 (no virtual devices found) even when every open() call failed due to insufficient permissions. The caller in src/local.c cannot distinguish a clean absence of virtual devices from a permission-denied scan and acts on the false negative by continuing authentication without denying. This vulnerability is fixed in 0.9.1.

In pam_usb, src/log.c contains a process-wide static pointer written on every PAM invocation with the address of a stack-local variable. This violates the PAM re-entrancy requirement and creates a data race when the PAM stack is invoked concurrently from multiple threads. The vulnerability is fixed in 0.9.1.

In pam_usb prior to 0.9.1, src/conf.c allocates heap memory proportional to n_devices, a count derived from libxml2 XPath evaluation of the config file, without first enforcing an upper bound. On 32-bit targets the multiplication n_devices * sizeof(t_pusb_device) wraps around size_t, causing xmalloc() to receive a very small size, and subsequent array writes overflow the heap. This vulnerability is fixed in 0.9.1.

In pam_usb prior to 0.9.0, multiple helper tools resolved external binaries through the PATH environment variable rather than using absolute paths. An attacker who can influence the process environment during PAM authentication or tool execution could substitute malicious binaries. The affected tools are pamusb-check (src/tmux.c), pamusb-conf (tools/pamusb-conf), and pamusb-keyring-unlock-gnome (tools/pamusb-keyring-unlock-gnome). This vulnerability is fixed in 0.9.0.

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb builds XPath expressions from user-supplied identifiers (PAM username, service name) and device-supplied identifiers (USB serial, model, vendor) to query /etc/pamusb.conf. These identifiers were not validated for XPath metacharacters, allowing injection of arbitrary XPath predicates.

In pam_usb before 0.9.0, out-of-memory guards in xmalloc(), xrealloc(), and xstrdup() relied on assert(data != NULL), which is compiled out when NDEBUG is defined (common in release builds). The functions then silently return NULL, and every caller dereferences the result without a NULL check, crashing the PAM module. A crash in a PAM module used by sudo or login causes a local denial-of-service condition. The vulnerability is fixed in 0.9.0.

Authlib to biblioteka Pythona, która buduje serwery OAuth i OpenID Connect. W wersjach przed 1.6.12 i 1.7.1 występowała nieautoryzowana otwarta przekierowanie w punkcie autoryzacji OpenIDImplicitGrant i OpenIDHybridGrant, co pozwalało zdalnemu atakującemu na wymuszenie wydania przez serwer autoryzacji HTTP 302 do wybranego przez atakującego adresu URL.

FacturaScripts to oprogramowanie do księgowości i fakturowania typu open source. W wersjach 2025.92 i wcześniejszych występuje podatność typu Cross-Site Scripting (XSS) w modalnym oknie wyszukiwania produktów, która pozwala na wykonanie dowolnego kodu JavaScript w przeglądarkach innych użytkowników.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.7 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed an authenticated user to access CI data from a different ref type than intended.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1. Under certain conditions an unauthorized user could enumerate private projects due to incorrect authorization checks.

GitLab EE has a vulnerability in versions from 18.7 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1. When foundational flows were enabled at the group level, an authenticated user with developer-role permissions could bypass flow restrictions under certain conditions.

Gryph, który zapewnia warstwę bezpieczeństwa dla agentów kodowania AI, przed wersją 0.7.0, implementował poziomy logowania, które określały, jakie treści są rejestrowane w lokalnej bazie danych sqlite. W rzeczywistości domyślny poziom logowania to standardowy, co prowadzi do rejestrowania potencjalnie wrażliwych treści plików.

FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in the product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation; the file is stored with its original extension, including executable .php. The vulnerability exists in the addImageAction() method of Core/Lib/ExtendedController/ProductImagesTrait.php.

FacturaScripts is an open source accounting and invoicing software. Prior to v2026, an unauthenticated information disclosure vulnerability in the Installer controller allows any remote attacker to trigger phpinfo() on a fresh deployment by requesting /?phpinfo=TRUE, exposing full PHP configuration, server environment variables (including database credentials, API keys, and application secrets), filesystem paths, and loaded extensions without authentication.

GitLab has remediated an issue in GitLab EE affecting all versions from 11.5 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1. Under certain conditions, an authenticated user with developer-role permissions could access sensitive deployment data on projects due to improper authorization checks.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1. Under certain conditions an authenticated user could cause denial of service due to insufficient validation.

Frappe HR to otwartoźródłowe rozwiązanie do zarządzania zasobami ludzkimi. Przed wersją 16.5.0, uwierzytelnieni pracownicy mogli uzyskać dostęp do szczegółów urlopów innych pracowników z powodu niewłaściwych kontroli autoryzacji.

go-ipld-prime to implementacja specyfikacji InterPlanetary Linked Data (IPLD), która przed wersją 0.23.0 miała problem z dekodowaniem DAG-CBOR i DAG-JSON. Dekodery te nie miały limitu głębokości rekurencji, co prowadziło do przepełnienia stosu w przypadku głęboko zagnieżdżonych kolekcji.

SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /OrderUtil.java components.

Klient Northern.tech Mender w wersji 5 przed 5.0.4 umożliwia obejście weryfikacji podpisu kryptograficznego. To może prowadzić do nieautoryzowanego dostępu do systemu.