CVE Vulnerability Catalog

An authenticated user can crash mongod by running $rankFusion or $scoreFusion with an empty pipeline on a view. The server reads the first element of the pipeline array without verifying it is non-empty, causing a null pointer dereference and crash.

CI4MS versions 0.26.0 to before 0.31.8.0 have the auth filter's deactivated/banned user check commented out. This issue is patched in version 0.31.8.0.

From version 0.31.1.0 to before 0.31.8.0, the deleteProcess() action in CI4MS accepts a POST parameter tables[] containing arbitrary table names passed directly to $forge->dropTable() without validating that they belong to the theme being deleted. An authenticated admin can craft a POST request with arbitrary table names and drop any table in the database.

When trace logging was enabled in Spring Cloud Config Server, sensitive information was written to logs in plain text. The issue affects 3.1.x, 4.1.x, 4.2.x, 4.3.x and 5.0.x branches within specific version ranges.

There is an openssl.cnf privilege escalation vulnerability in the ZTE Cloud PC client uSmartview. An attacker can execute arbitrary code locally and escalate privileges.

The BootROM in ZTE ZX297520V3 contains a vulnerability allowing arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in USB download mode to overwrite the stack, hijack execution flow, and bypass Secure Boot signature verification.

In OpenTelemetry.Exporter.OneCollector versions 1.15.0 and earlier, when a request to the configured back-end or collector results in an unsuccessful HTTP 4xx or 5xx response, the HttpJsonPostTransport class reads the entire response body into memory with no upper bound on bytes consumed. An attacker who controls the endpoint or performs a man-in-the-middle attack can return an arbitrarily large response body, causing unbounded heap allocation, memory pressure, GC stalls, or an OutOfMemoryException that terminates the process.

OpenTelemetry.Resources.Azure versions 1.15.0-beta.1 and earlier read the Azure VM instance metadata service response into memory without any size limit. An attacker controlling the endpoint or performing a man-in-the-middle attack can return an arbitrarily large response, causing unbounded heap allocation and potentially terminating the process.

The Zipkin exporter in OpenTelemetry.Exporter.Zipkin versions 1.15.2 and earlier has unbounded key growth in the remote endpoint cache derived from span attributes. In high-cardinality scenarios, this leads to excessive memory usage and degraded availability.

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The HTML writer skips htmlspecialchars escaping when a cell's formatted value differs from the original value, allowing stored cross-site scripting when a spreadsheet is converted to HTML and displayed.

Samsung Print Service Plugin for Android is potentially vulnerable to information disclosure when using an outdated version of the application via mobile devices. HP is releasing updates to mitigate these potential vulnerabilities.

In Incus before version 7.0.0, missing validation in the storage volume import logic allows an authenticated user with access to the storage volume feature to crash the Incus daemon. The backup restore subsystem contains an out-of-bounds panic due to an incorrect bounds check len(slice) >= i-1 when indexing snapshot metadata arrays, also present in the migration path. An attacker can submit a backup archive with physical snapshot directories and a tampered index.yaml with an empty or truncated metadata array, causing the daemon to crash and resulting in denial of service. The issue is fixed in version 7.0.0.

In Incus before 7.0.0, broken TLS validation logic in OVN database connections means the custom verifier does not anchor trust in the configured CA but instead uses peer-supplied certificates. This allows an active attacker to impersonate the OVN endpoint with a rogue certificate chain.

In Incus before version 7.0.0, missing validation in the storage volume import logic allows an authenticated user with access to the storage volume feature to crash the Incus daemon. The custom volume backup import subsystem contains a nil-pointer dereference during import: the snapshot import loop iterates over srcBackup.Config.VolumeSnapshots and assumes each element is initialized, then dereferences fields such as Name, Config, Description, CreatedAt, and ExpiresAt without validation. Because the YAML unmarshaler accepts explicit null array elements from an attacker-controlled index.yaml and converts them into nil pointers, an attacker can supply a backup archive with a null entry in the volume_snapshots array, causing a nil-pointer dereference and terminating the daemon. The issue is fixed in version 7.0.0.

In Incus before version 7.0.0, missing validation in the storage bucket import logic allows an authenticated user with access to the storage bucket feature to crash the Incus daemon. The daemon processes the index.yaml file from an imported archive and accesses members of the parsed backup configuration without first verifying that the configuration object was initialized. A malicious or malformed index.yaml that omits the config block causes a nil-pointer dereference during bucket import and terminates the daemon, resulting in denial of service. The issue is fixed in version 7.0.0.

A vulnerability in PicoTronica e-Clinic Healthcare System ECHS 5.7 in the file /cdemos/echs/api/v2/ leads to information disclosure. The attack can be performed remotely, and the exploit has been publicly disclosed.

In PicoTronica e-Clinic Healthcare System ECHS 5.7, the file /cdemos/echs/api/v2/patient-records (API Endpoint component) contains an unknown function with missing authentication. The attack can be executed remotely, and the exploit is publicly available and may be used. Upgrading to version 5.7.1 is sufficient to fix the issue.

Script injection in the UI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.

Uninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page.

Insufficient policy enforcement in WebApp in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to perform UI spoofing via a crafted HTML page.