CVE Vulnerability Catalog

libgphoto2 up to and including 2.5.33 has an out-of-bounds read in the PTP_DPFF_Enumeration case of ptp_unpack_Sony_DPD() in camlibs/ptp2/ptp-pack.c (line 856). The function reads a 2-byte enumeration count N via dtoh16o(data, *poffset) without verifying that 2 bytes remain in the buffer. The standard ptp_unpack_DPD() at line 704 has this check, confirming the Sony variant omitted it by oversight. Commit 3b9f9696be76ae51dca983d9dd8ce586a2561845 fixes the issue.

The Sentry kernel is a high security level micro-kernel implementation made for high security embedded systems. A task with one of the DEV or IO capability is able to interact with another task's IRQ line through the __sys_int_* syscall family. Prior to version 0.4.7, this can lead to DoS and covert channels between this task and the outer world.

libgphoto2 versions up to and including 2.5.33 have an out-of-bounds read in ptp_unpack_DPV() in camlibs/ptp2/ptp-pack.c. The UINT128 and INT128 cases advance the offset by 16 bytes without verifying that 16 bytes remain in the buffer.

libgphoto2 versions up to and including 2.5.33 have two functions in camlibs/ptp2/ptp-pack.c that accept a data pointer but no length parameter, performing unbounded reads. Their callers in ptp_unpack_EOS_events() have xsize available but never pass it, leaving both functions unable to validate reads against the actual buffer boundary. Commit 1817ecead20c2aafa7549dac9619fe38f47b2f53 patches the issue.

All new installations of DNN 10.x.x through 10.2.1 share the same Host GUID. This does not affect upgrades from 9.x.x. Version 10.2.2 patches the issue.

In the DNN friends feature, versions 6.0.0 through 10.2.2 allowed a user to craft a request that forced acceptance of a friend request on another user. Version 10.2.2 patches the issue.

zrok prior to version 2.0.1 contains a logical error in the ownership guard in the unaccess handler (controller/unaccess.go): when a frontend record has environment_id = NULL (the marker for admin-created global frontends), the condition short-circuits to false and allows deletion without ownership verification. A non-admin user who knows a global frontend token can permanently delete the global frontend, causing all public shares routed through it to become unavailable.

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the proxyUi template engine uses Go's text/template (no HTML escaping) instead of html/template, and the GitHub OAuth callback handlers in publicProxy and dynamicProxy embed the attacker-controlled refreshInterval parameter unescaped into an error message. An attacker can deliver a crafted login URL so that, after the victim completes the GitHub OAuth flow, the callback page executes arbitrary JavaScript in the OAuth server's origin.

DOMSanitizer (PHP 7.3+) before 1.0.10 allows <style> elements in SVG content but never inspects their text content. CSS url() references and @import rules pass through unfiltered, causing the browser to issue HTTP requests to attacker-controlled hosts when the sanitized SVG is rendered.

Applications using the next-intl middleware prior to version 4.9.1 with localePrefix: 'as-needed' could construct URLs where path handling and the WHATWG URL parser resolved a relative redirect target to another host (e.g., scheme-relative '//' or control characters stripped by the URL parser), so the middleware could redirect the browser off-site while the user still started from a trusted app URL.

In OpenFGA versions 0.1.4 through 1.13.1, when configured with preshared-key authentication and the built-in playground enabled, the local server includes the preshared API key in the HTML response of the /playground endpoint. This endpoint is enabled by default and does not require authentication, potentially leading to sensitive data exposure.

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript via the "Destinatário" field; the payload is stored and later executed when viewing the dispatch page, impacting other users. Version 3.6.10 fixes the issue.

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the Intercorrências notification page, which is executed when a user accesses the page, enabling session hijacking and account takeover. Version 3.6.10 fixes the issue.

xrdp through 0.10.5 allows an authenticated remote user to execute arbitrary commands due to unsafe handling of the AlternateShell parameter in xrdp-sesman. When AllowAlternateShell is enabled (default), the client-supplied value is executed via /bin/sh -c during session initialization. This is fixed in version 0.10.6.

WeGIA versions prior to 3.6.10 contain a stored XSS vulnerability that allows an authenticated user to inject malicious JavaScript via the "Nome" field on the "Informações Pacientes" page. The payload is stored and executed when patient information is viewed. Version 3.6.10 fixes the issue.

Anviz CX7 Firmware is vulnerable to unauthenticated retrieval of the most recently captured test photo, revealing sensitive operational imagery.

Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, enabling on-path attackers to sniff credentials and session data, which can be used to compromise the device.

Anviz CX7 Firmware is vulnerable to an unauthenticated POST request to the device that captures a photo with the front-facing camera, exposing visual information about the deployment environment.

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated access that discloses debug configuration details (e.g., SSH/RTTY status), assisting attackers in reconnaissance against the device.

xrdp through version 0.10.5 contains a heap-based buffer overflow in logon processing. When domain_user_separator is configured in xrdp.ini, an unauthenticated remote attacker can send a crafted, excessively long username and domain name to overflow the internal buffer, corrupting adjacent memory and potentially causing a Denial of Service (DoS) or unexpected behavior.