CVE Vulnerability Catalog

Vvveb CMS before 1.0.8.1 contains a stored XSS vulnerability in the comment submission flow. The author field is submitted by an unauthenticated user on any public post page, stored without sanitization, and later rendered unsanitized in two distinct sinks.

Microsoft APM prior to 0.13.0 contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by apm install <bundle> on Python 3.10 and 3.11. When a local .tar.gz is not recognized as a plugin-format bundle, APM extracts untrusted tar members with raw tar.extractall() without rejecting Windows absolute member names such as D:/.... The vulnerability is fixed in 0.13.0.

Gitsign is a keyless Sigstore signing tool for Git commits with a GitHub/OIDC identity. From 0.4.0 to before 0.15.0, CertVerifier.Verify() unconditionally dereferences certs[0] after sd.GetCertificates() without checking the slice length; a CMS/PKCS7 signed message with an empty certificate set causes an index-out-of-range panic that is silently recovered on the gitsign --verify path, returning exit code 0 and causing failed verification to be interpreted as success. This is fixed in 0.15.0.

Gitsign is a keyless Sigstore signing tool for Git commits with a GitHub/OIDC identity. Prior to 0.16.0, gitsign verify and gitsign verify-tag re-encode commit/tag objects through go-git's EncodeWithoutSignature before checking the signature; for malformed objects with duplicate tree headers, git-core and go-git parse different trees, so a signature over the go-git-normalized form passes verification while git-core resolves a different tree. This is fixed in 0.16.0.

Magento Long Term Support (LTS) before 20.18.0 contains a reflected XSS vulnerability in the admin panel under System -> Import/Export -> Dataflow - Profiles. The vulnerability is fixed in 20.18.0.

Magento Long Term Support (LTS) before 20.18.0 contains an open redirect vulnerability in Mage_ProductAlert_AddController::stockAction(), which reads the uenc query parameter and passes it directly to $this->_redirectUrl($backUrl) without calling $this->_isUrlInternal(). When the supplied product_id does not match any catalog product, the server issues an unvalidated HTTP 302 redirect to whatever URL was provided as uenc.

Cockpit CMS up to version 2.14.0 contains a stored cross-site scripting vulnerability in the Set field type's Display template option. The template string is processed by the $interpolate function using new Function() and rendered via Vue's v-html directive without sanitization, allowing an attacker with content/:models/manage permission to inject arbitrary JavaScript.

Turborepo is a build system for JavaScript and TypeScript. Prior to 2.9.14, self-hosted login and SSO browser flows did not validate a CSRF state value on the localhost callback; a malicious web page could send a request with an attacker-controlled token, and the CLI could complete login with the wrong credentials. This is fixed in 2.9.14.

Imager versions through 1.030 for Perl allow a heap out-of-bounds (OOB) write on crafted multi-frame GIF files. i_readgif_multi_low allocates a single GifRow buffer sized for the global screen width and reuses it across every image, and the skip-image branch calls DGifGetLine without bounds checks.

The 'ws' WebSocket library for Node.js prior to 8.20.1 has a vulnerability that discloses uninitialized memory when closing a connection with a TypedArray as the reason argument.

Medical Management System a81df1ce700a9662cb136b27af47f4cbde64156b is vulnerable to insecure permissions, allowing arbitrary user password reset.

Countermeasures for DPA within the SYMCRYPTO engine on SixG301xxx devices are not sufficiently random and will eventually repeat. KSU keys using SYMCRYPTO will be impacted by this vulnerability.

Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session IDs. The default generator returns a SHA-256 hash of the built-in rand() function, epoch time, and PID, which are predictable, low-entropy sources, potentially allowing an attacker to gain access to systems.

Imager::File::GIF versions through 1.002 for Perl allow a heap out of bounds write on crafted multi-frame GIF files. The per-row buffer is sized for the global screen width and reused, and the skip-image branch lacks a width check before writing.

A permission control vulnerability in the security control module allows bypassing access control mechanisms. Successful exploitation may affect service confidentiality.

Out-of-bounds write vulnerability in the distributed file system module. Successful exploitation of this vulnerability may affect availability.

A permission control vulnerability exists in the projection module. Successful exploitation of this vulnerability may affect service confidentiality.

Permission control vulnerability in the manufacturability design module. Impact: Successful exploitation of this vulnerability may affect availability.

Permission control vulnerability in the manufacturability design module. Impact: Successful exploitation of this vulnerability may affect availability.

Permission control vulnerability in the smart sensing service. Successful exploitation of this vulnerability may affect service confidentiality.