CVE Vulnerability Catalog

Vulnerability in GPAC up to version 2.4.0 in the MergeFragment function of src/isomedia/isom_intern.c in the MP4Box component causes a null pointer dereference via a local attack. Exploit has been published.

A path traversal vulnerability was found in Magic Wormhole before version 0.24.0 when receiving files with the '--output <dir>' option and the target directory already exists. This allows writing files outside the intended directory.

A cross-site scripting vulnerability was found in the Hospitals Patient Records Management System version 1.0 in the file /admin/?page=patients/view_patient. Manipulation of the Remarks argument allows remote script injection. The exploit is publicly available.

Bugsink before 2.2.0 has a vulnerability where the issue list authorizes access via the project in the URL but applies bulk actions to submitted issue IDs without verifying they belong to that project. Fixed in 2.2.0.

Bugsink before 2.2.0 has a vulnerability where issue event pages accept a direct event identifier from the URL without verifying it belongs to the issue. A user with access to one project can view another project's event data. Fixed in 2.2.0.

This vulnerability stems from a business logic flaw. Attackers can exploit legitimate application functions in unintended and abnormal ways, deviating from the designer's expectations, to carry out malicious attacks.

In GNU LibreDWG up to 0.14, a vulnerability was found in the function read_2004_compressed_section of src/decode.c in the Dwgbmp Utility component. Manipulation can lead to out-of-bounds read. Local access is required.

In GNU LibreDWG up to 0.14, a vulnerability was found in the function match_BLOCK_HEADER of dwggrep.c in the Dwggrep Utility component. Manipulation leads to null pointer dereference. Local access is required.

The GDPR cookies module for Backdrop CMS before version 1.x-1.3.5 does not sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has been provided for the optional 'Info content' field for the YouTube service. The attack is mitigated by the fact that an attacker must have a role with permission to create or edit GDPR Cookies services and the site must have a YouTube service configured.

A weakness has been identified in GNU LibreDWG up to version 0.14, affecting the bit_convert_TU function in programs/dwggrep.c of the Dwggrep Utility component. This manipulation causes an out-of-bounds read. The attack requires local access and the exploit has been made public.

In GNU LibreDWG up to 0.14, a vulnerability was found in the function dwg_next_entity of src/decode.c in the DWG File Handler component. Manipulation leads to null pointer dereference. Local access is required.

In GNU LibreDWG up to 0.14, a vulnerability was found in the function decompress_R2004_section of src/decode.c in the Dwgread Utility component. Manipulation can lead to reachable assertion. Local access is required.

PuTTY versions 0.71 through 0.83 have an assertion failure in ECDSA signature verification. The issue is fixed in version 0.84.

In PuTTY versions 0.77 through 0.83, the PuTTY icon is used as a trust indicator for TELNET data, but the trust status is not cleared between proxy authentication and the main session.

PuTTY versions 0.72 through before 0.84 have a double free vulnerability in RSA KEX handling.

A cross-site scripting vulnerability was found in SourceCodester Student Grades Management System 1.0 in the students.php file via the Remarks argument. Remote attack is possible. Exploit is publicly available.

Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1 allow pre-authentication arbitrary file deletion via Redis/Memcache session poisoning.

A cross-site scripting vulnerability was found in StudentManagementSystem (commit cb2f558d) in the /student.php file via the FIRST_NAME argument. Remote attack is possible. Exploit is publicly available. The project has not responded.

In SourceCodester Indian Invoicing System up to version 1.0, the file /Invoicing/add_order.php in the Invoice Template Render Database-Backed component is vulnerable to cross-site scripting via the customer_name argument. The attack can be launched remotely, and the exploit has been publicly released.

In SPIP before version 4.4.15, the file action/cookie.php in the ecrire directory is prone to an open redirect vulnerability.