CVE Vulnerability Catalog

In Pillow prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size without rerunning Image._decompression_bomb_check(). A tiny file can use a safe first frame to pass Image.open() and then declare very large dimensions in a later mode F frame. Loading that frame allocates approximately four bytes per attacker-declared pixel and can consume multiple gigabytes of memory. This issue is fixed in version 13.0.0.

Pillow, a Python imaging library, prior to 13.0.0 allows MpoImageFile.seek() and DcxImageFile.seek() to reparse later MPO or DCX frames and replace self._size without rerunning Image._decompression_bomb_check(). A crafted multi-frame image can use a tiny first frame to pass Image.open() and then declare an over-limit later frame, which during normal frame iteration through seek(), load(), or ImageSequence.Iterator can decode that frame and commit hundreds of megabytes or more, causing memory-exhaustion denial of service.

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities that signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could exploit this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by TLS/SSL clients using the system CA store. Due to the inability to distrust only specific intermediate certificates in all clients, root CA certificates of authorities that signed weak intermediate certificates are being removed.

A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. Impacted is an unknown function of the file /inserttrans.php. Performing a manipulation of the argument prcd results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument output_path causes file inclusion. Remote exploitation of the attack is possible. Patch name: 1d42459c292f89e412f7f6243829e7fed2e85bf5.

A vulnerability was detected in itsourcecode Online Cake Ordering System 1.0. This affects an unknown part of the file /deleteproduct.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process.

A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered before the Configure OTP action in a realm, the system may fail to enforce mandatory multi-factor authentication enrollment during the login process. This issue allows an attacker with a valid password to access an account without setting up the required one-time password (OTP) credential.

In leomoon-studios wiki-go up to 1.9.1, the SaveHandler/SourceHandler functions in internal/handlers/editor.go (API component) are vulnerable to path traversal via input manipulation. The attack can be launched remotely, and a public exploit may be used in attacks.

In leomoon-studios wiki-go up to 1.9.1, the RenameFileHandler function in internal/handlers/files.go (Files Rename API component) is vulnerable to path traversal via manipulation of the currentPath/newName arguments. The attack can be initiated remotely, and a public exploit may be used in attacks.

A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadata_api.go of the fetch-metadata Endpoint component. Such manipulation leads to server-side request forgery. The attack can be launched remotely and the exploit is publicly available.

A flaw was found in HarnessRouter up to 0.31.12 affecting an unknown function in gateway/app.py of the Targets Test Endpoint component. Manipulating the base_url argument can lead to server-side request forgery, exploitable remotely.

Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports. This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0.

Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until the connection times out, because it waits for the trailer bytes it has already dropped. Trailer dropping is on by default in 10.x. In 8.1.11 and 9.2.x it is off by default, and those versions are affected only if it is enabled. This issue affects Apache Traffic Server: 8.1.11, from 9.2.5 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.

The Nuvoton NPCX eSPI driver's espi_taf_parse() processes TAF requests without validating the 12-bit length field from the request header. For write and RPMC OP1 requests it copies up to 255 words into a fixed 16-word buffer in a static structure, causing an out-of-bounds write of roughly 956 bytes into .bss and reads past neighbouring eSPI registers. The same unvalidated length is passed to flash_write(), letting the host read up to 4 KB of adjacent controller SRAM.

The Infineon PSOC 6 BLESS HCI driver stored the outgoing HCI packet descriptor in a file-scope variable shared across threads, while the serialising semaphore protected only the call into the controller, not the shared state that call reads. Concurrent transmissions from different threads can cause the controller to receive a descriptor with mismatched fields (dataLength from one buffer, data pointer from another), leading to disclosure of adjacent RAM or loss/duplication of HCI packets.

The Broadcom AFBR-S50 time-of-flight sensor driver in Zephyr RTOS double-completes an RTIO submission when sensor data evaluation fails. The error branch in data_ready_work_handler() calls handle_error_on_result() but does not return, so the same struct rtio_iodev_sqe is finalised a second time via rtio_iodev_sqe_ok(). This causes use-after-free, double-free of the pool entry, and writes through a released buffer.

A vulnerability in the Zephyr device multiplexer pseudo-driver (devmux) is caused by missing permission validation in the syscall verifiers for user-mode callers. With CONFIG_USERSPACE and CONFIG_DEVMUX enabled, a user thread can read and change the multiplexer's downstream device selection without authorization, because devmux devices are not registered as kernel objects and cannot be subject to access control.

A vulnerability was detected in HarnessRouter up to 0.31.10 in the file gateway/app.py of the Identity Mode component. Manipulating the X-Harness-Org/X-Harness-Member arguments results in improper authorization. The attack is remotely possible, with high complexity and difficult exploitability.

A security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.0 in the mysqli_query function of profile.php. Manipulation of the admin_id argument leads to SQL injection. The attack can be carried out remotely, and the exploit has been publicly disclosed.