CVE Vulnerability Catalog

In the Cpanel::JSON::XS Perl library (versions before 4.80), the decoded key of an object rejected for a duplicate key or a missing colon leaks in decode_hv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is not freed when the object is rejected.

IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms. This could allow an attacker to decrypt highly sensitive information.

IBM Cloud Pak System 2.3.6.0 and 2.3.6.1 is vulnerable to cross-site scripting. User-supplied input is not properly sanitized or HTML-encoded before being stored and rendered, allowing an authenticated attacker to store malicious JavaScript (Stored XSS).

CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection. This allows attackers to relay valid Evidence from a genuine attester, and holders of an extracted attested TLS private key can replay Evidence to impersonate the attested workload.

markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, leading to denial of service. The issue occurs with many opening double quotes followed by unmatched closing single quotes.

follow-redirects versions 1.16.0 through 1.16.1 fail to escape regex metacharacters (^ or |) in sensitive header names. As a result, on cross-origin or HTTPS-to-HTTP redirects, the generated filter does not match the declared header and the credential header is forwarded to an attacker-controlled redirect target. The issue is fixed in version 1.16.1.

Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 is vulnerable to CSRF in admin/modules/circulation/loan_history_maintenance.php because the action=run GET parameter performs privileged, destructive operations without a CSRF token or POST confirmation. This can lead to loss of loan history records.

Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow in the local onboarding Wi-Fi configuration path. An authenticated attacker on the adjacent network can submit a crafted request with an oversized encrypted password field, overwrite stack state, and execute commands with root privileges. Successful exploitation may allow taking control of the camera, modifying its behavior, accessing sensitive local configuration, and disrupting device availability.

A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of FFmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) by processing a crafted media file.

IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment. The vulnerability occurs in the TLS certificate processing.

IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes for Java. The vulnerability occurs in the Java deserialization mechanism.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.

IBM MQ contains a vulnerability due to improper validation of buffer sizes in MQOPEN operations. An authenticated attacker could exploit this flaw to cause a denial of service or memory corruption.

IBM MQ contains a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties. An authenticated attacker could cause a denial of service or potentially execute arbitrary code.

IBM MQ contains a heap buffer overflow when processing MQPUT operations with malformed message options. An authenticated attacker could cause a denial of service or potentially execute arbitrary code.

A user can access any database details, such as usernames and passwords, by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads without authentication; database write and delete operations may also be possible, but this was untested.

An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.

Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, because escape_string() is applied but the values are concatenated into an unquoted numeric SQL context, leading to error-based information disclosure and arbitrary data extraction.

PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes it as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.