CVE Vulnerability Catalog

Apache OFBiz before 24.09.06 contains an Expression Language Injection vulnerability due to improper neutralization of special elements.

Apache OFBiz before 24.09.06 contains Cross-site Scripting (XSS), Path Traversal, and Code Injection vulnerabilities due to improper input neutralization and pathname restrictions.

Apache OFBiz before 24.09.06 contains an Improper Input Validation vulnerability.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

Apache OFBiz before 24.09.06 contains a Template Engine Injection vulnerability due to improper neutralization of special elements. In version 24.09.06, "Data Resource" records with dataTemplateTypeId = "FTL" are no longer supported, and the "Ecommerce Customer" security group no longer includes content management grants.

Unauthorized access vulnerability in ZTE MU5250 due to improper permission control of the Web interface allows an unauthorized attacker to modify configuration.

In Keycloak, when both realm-level and client-level `notBefore` revocation policies are configured, the OIDC Introspection feature fails to honor the realm-level policy, leaving tokens that should be revoked active.

Samsung Open Source Escargot is vulnerable to uncontrolled recursion leading to excessive memory allocation. The issue affects commit 590345cc6258317c5da850d846ce6baaf2afc2d3.

Samsung Open Source Escargot is vulnerable to improper check or handling of exceptional conditions, allowing input data manipulation. The issue affects commit 590345cc6258317c5da850d846ce6baaf2afc2d3.

Samsung Open Source Escargot is vulnerable to improper check for unusual or exceptional conditions, allowing input data manipulation. The issue affects commit 590345cc6258317c5da850d846ce6baaf2afc2d3.

Samsung Open Source Escargot is vulnerable to memory allocation with excessive size value, leading to excessive allocation. The issue affects commit 590345cc6258317c5da850d846ce6baaf2afc2d3.

Samsung Open Source Escargot is vulnerable to release of invalid pointer or reference, allowing buffer manipulation. The issue affects commit 590345cc6258317c5da850d846ce6baaf2afc2d3.

An authenticated user can bypass configured WebAuthn policies during credential registration by manipulating client-side JavaScript. The server fails to validate that the new credential's parameters match the realm's WebAuthn policies.

The exifreader package before version 4.39.0 is vulnerable to Improper Handling of Highly Compressed Data due to decompressing PNG zTXt metadata without enforcing a built-in maximum decompressed output size. When asynchronous parsing is enabled, a crafted PNG file can cause ExifReader to materialize a disproportionately large Comment value in memory.

Samsung Open Source Escargot is vulnerable to uncontrolled recursion, allowing oversized serialized data payloads. The issue affects commit 590345cc6258317c5da850d846ce6baaf2afc2d3.

NULL pointer dereference vulnerability in Samsung Open Source Walrus allows Pointer Manipulation. The issue affects a specific commit in the Walrus repository.

The /api/v1/autotranslate.translateMessage endpoint in Rocket.Chat (versions before 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, 7.10.12) allows any authenticated user to retrieve the full content of any message from any room without access check.

A NULL pointer dereference vulnerability in Samsung Open Source Walrus allows an attacker to cause a denial of service via a crafted WebAssembly module containing deeply nested instructions. The issue affects a specific commit of the repository.

In OpenHarmony v6.0 and prior versions, a vulnerability allows a local attacker to execute arbitrary code.

Vulnerability in OpenHarmony v6.0 and prior versions allows a local attacker to cause information leak.