CVE Vulnerability Catalog

ERPNext version 15.103.1 and earlier is vulnerable to Cross-Site Scripting (XSS) in the Email Template engine. An attacker with permission to create or edit email templates can inject malicious JavaScript code that executes in the victim's browser when the template is applied.

In Langchain-Chatchat up to version 0.3.1.3, a vulnerability involves missing authentication in the Compatible File Service component. Functions files/list_files/retrieve_file/retrieve_file_content/delete_file in openai_routes.py lack authentication. The attack requires local network access. The exploit is public.

In Django versions 6.0 before 6.0.5 and 5.2 before 5.2.14, django.middleware.cache.UpdateCacheMiddleware erroneously caches requests where the Vary header contained an asterisk ('*'), which can lead to private data being stored and served.

In Django versions 6.0 before 6.0.5 and 5.2 before 5.2.14, ASGI requests with a missing or understated Content-Length header can bypass the FILE_UPLOAD_MAX_MEMORY_SIZE limit, potentially loading large files into memory and causing service degradation.

W jądrze systemu Linux zidentyfikowano i rozwiązano podatność związaną z mylącą nazwą funkcji '__copy_user_nocache()'. Funkcja ta, mimo że twierdziła, że jest to kopiowanie użytkownika bez pamięci podręcznej, w rzeczywistości nie spełniała tych założeń i była źródłem nieporozumień w kontekście jej użycia.

W jądrze Linuxa zidentyfikowano podatność związaną z funkcją platform_get_irq_byname(), która może zwracać wartość ujemną w przypadku błędu. Należy to sprawdzić przed przekazaniem do devm_request_threaded_irq().

In the Linux kernel, ext4_mb_find_by_goal() may attempt to allocate a block from a corrupted block group. When ext4_mb_load_buddy() returns an error due to a corrupted block bitmap, allocation fails, leading to data loss (errors 'Delayed block allocation failed' and 'Data will be lost').

W jądrze Linuxa zidentyfikowano podatność w systemie plików ext4, która polega na tym, że po usunięciu plików i remountowaniu systemu z opcją nodiscard, oczekujące zadania związane z usuwaniem nie są anulowane ani opróżniane. Problem ten został rozwiązany w najnowszej aktualizacji.

A vulnerability in the Linux kernel related to not releasing the workqueue when freeing an object for a DSA/IAA device has been fixed.

W jądrze Linuxa rozwiązano podatność związaną z blokadą TX podczas korzystania z DMA w sterowniku 8250. Problem polegał na tym, że `dmaengine_terminate_async` nie gwarantowało uruchomienia callbacka `__dma_tx_complete`, co mogło prowadzić do sytuacji, w której `dma->tx_running` nigdy nie zostanie wyczyszczone.

W podatności typu Buffer Overflow w GPAC przed commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702, atakujący może spowodować awarię usługi poprzez funkcje svg_parse_strings() oraz gf_svg_parse_attribute() w pliku src/scenegraph/svg_attributes.c.

In Django 6.0 before 6.0.5 and 5.2 before 5.2.14, response headers do not vary on cookies when a session is not modified but SESSION_SAVE_EVERY_REQUEST is True. A remote attacker can steal a user's session after the user visits a cached public page. Earlier unsupported series (5.0.x, 4.1.x, 3.2.x) were not evaluated and may also be affected.

A flaw was found in Open vSwitch. When configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in Denial of Service (DoS).

A flaw was found in the X.Org X server related to an out-of-bounds read affecting XKB modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, leading to reading beyond intended memory boundaries.

A flaw was found in the X.Org X server that allows for out-of-bounds memory read in XKB geometry processing. An attacker can exploit this vulnerability to read uninitialized memory or out-of-bounds memory, potentially leading to memory disclosure or server crashes.

Jupyter Server versions through 2.17.0 have insufficient validation of the next query parameter in the login flow within LoginFormHandler._redirect_safe(), allowing redirects to arbitrary external domains. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks.

ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage. This allows an attacker to inject malicious scripts into the administrator's browser.

An issue that could allow a dashboard configuration to be viewed from outside of the authorized organization scope has been resolved. This is an instance of CWE-269: Improper Privilege Management, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N (5.0, Medium). This issue was fixed in version v4.0.260416.0 of the runZero Platform.

In the Fiber web framework for Go through version 3.1.0, the default key generator in the cache middleware uses only the request path and omits the query string. As a result, requests to the same path with different query parameters can share a cache key and receive the wrong cached response. The issue is fixed after version 3.1.0.

The Betheme theme for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 28.4. The upload_icons() function uses a user-controlled upload path (mfn-icon-upload) in a filesystem move operation without constraining it to the uploads directory, allowing authenticated attackers with contributor-level access and above to move/delete arbitrary local files via path traversal.