CVE Vulnerability Catalog

A vulnerability in Wasmtime (versions 28.0.0 to before 36.0.7, 42.0.2, and 43.0.1) in the pooling allocator implementation incorrectly determines whether to reset virtual memory permissions for linear memory. Due to a divergence between compile-time and runtime predicates, under specific configurations (memory_guard_size=0, memory_reservation < 4GiB, max_memory_size equal to memory_reservation) linear memory contents can leak between instances. This breaks WebAssembly semantics and the Wasmtime sandbox.

In Wasmtime 43.0.0, cloning a wasmtime::Linker is unsound and can result in use-after-free bugs. The bug is not controllable by guest Wasm programs; it can only be triggered by a specific sequence of embedder API calls by the host: clone a Linker, drop the original, then use the clone. The vulnerability is fixed in 43.0.1.

Wasmtime from 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1 has a bug in the Winch compiler where a 64-bit table (part of the memory64 proposal) incorrectly translates the table.size instruction. This can disclose host stack data to WebAssembly guests. The bug arose from statically typing the return value as a 32-bit integer instead of consulting the table's index type.

Wasmtime, a WebAssembly runtime, prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1 on x86-64 platforms with SSE3 disabled may load 8 more bytes than necessary when compiling the f64x2.splat instruction with Cranelift. With signals-based traps disabled this can cause an uncaught segfault, and with guard pages disabled out-of-sandbox data may be loaded (not visible to WebAssembly guests).

In Wasmtime prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, the implementation of transcoding strings into the Component Model's utf16 or latin1+utf16 encodings improperly verified the alignment of reallocated strings. Unaligned pointers could be passed to the host for transcoding, triggering a host panic that a malicious guest can deliberately cause.

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, the redirect parameter upon login to LORIS was not validating the value of the redirect as being within LORIS, which could be used to trick users into visiting arbitrary URLs if they are given a link with a third party redirect parameter. This vulnerability is fixed in 27.0.3 and 28.0.1.

Aiven Operator from 0.31.0 to before 0.37.0 allows a developer with create permission on ClickhouseUser CRDs in their own namespace to exfiltrate secrets from any other namespace (production database credentials, API keys, service tokens) with a single kubectl apply. The operator reads the victim's secret using its ClusterRole and writes the password into a new secret in the attacker's namespace, acting as a confused deputy without validating spec.connInfoSecretSource.namespace.

Unhead prior to version 2.1.13 contains a vulnerability in the hasDangerousProtocol() function in packages/unhead/src/plugins/safe.ts, which decodes HTML entities before checking for blocked URI schemes (javascript:, data:, vbscript:). The decoder uses regular expressions with fixed-width digit caps, and when a padded entity exceeds the limit, it is silently skipped, allowing bypass of the filter and injection of malicious URIs.

plugin-deepinid in dde-control-center (the Deepin Desktop Environment control panel) prior to 6.1.80 skips TLS certificate verification when fetching the user's avatar from openapi.deepin.com or other providers. An MITM attacker could intercept traffic, replace the avatar with a malicious or misleading image, and potentially identify the user. Fixed in 6.1.80 and 5.9.9.

A Cross Site Scripting vulnerability in LimeSurvey v.6.15.20+251021 allows a remote attacker to execute arbitrary code via the Box[title] and box[url] parameters.

A Reflected Cross-Site Scripting (XSS) affects LimeSurvey versions prior to 6.15.11+250909, due to the lack of validation of the gid parameter in the getInstance() function in application/models/QuestionCreate.php. This allows an attacker to craft a malicious URL and compromise the logged-in user.

In Lychee before 7.5.4, a SQL operator-precedence bug in SharingController::listAll() causes the orWhereNotNull('user_group_id') clause to bypass the ownership filter. An authenticated non-admin user with upload permission and at least one album can retrieve all user-group-based sharing permissions, including private albums owned by others.

osslsigncode version 2.12 and earlier contains an out-of-bounds read vulnerability in the PE page-hash computation code (pe_page_hash_calc()). The function uses PointerToRawData and SizeOfRawData values from section headers without validating that the referenced region lies within the mapped file, allowing reads from an invalid memory region and potentially crashing the process.

osslsigncode versions 2.12 and earlier contain an integer underflow vulnerability in the PE page-hash computation code (pe_page_hash_calc()). When a malicious PE file sets SizeOfHeaders (hdrsize) larger than SectionAlignment (pagesize), the subtraction underflows, producing a very large unsigned length, which leads to an out-of-bounds heap read and can crash the process. The vulnerability can be triggered while signing a malicious PE file with page hashing enabled (-ph), or while verifying a malicious signed PE file that already contains page hashes. This is fixed in 2.13.

A weakness has been identified in code-projects Patient Record Management System 1.0 affecting an unknown part of the file /db/hcpms.sql in the SQL Database Backup File Handler component. Manipulation can lead to information disclosure, the attack can be launched remotely, and a public exploit is available.

A flaw was found in libcap. A local unprivileged user can exploit a TOCTOU race condition in the `cap_set_file()` function, allowing an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file.

ChurchCRM prior to 7.1.0 has an XSS vulnerability where attacker-supplied input via the EName and EDesc parameters in EditEventAttendees.php is rendered without proper output encoding, enabling arbitrary JavaScript execution in victims' browsers. This is fixed in 7.1.0.

fast-jwt versions 5.0.0 to 6.2.0 have a denial-of-service condition when the allowedAud verification option is configured with a regular expression. Because the aud claim is attacker-controlled, a crafted JWT can trigger catastrophic backtracking in the JavaScript regex engine, causing significant CPU consumption. This is fixed in 6.2.1.

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.1, using certain modifiers on RegExp objects in the allowedAud, allowedIss, allowedSub, allowedJti, or allowedNonce options in verify functions can cause certain unintended behaviours. This is because some modifiers are stateful and will cause failures in every second verification attempt regardless of the validity of the token provided. Such modifiers are /g (global matching) and /y (sticky matching). This does NOT allow invalid tokens to be accepted, only for valid tokens to be improperly rejected in some configurations. Instead it causes 50% of valid authentication requests to fail in an alternating pattern. This vulnerability is fixed in 6.2.1.

Improper Handling of Insufficient Privileges in Apache OpenMeetings allows any registered user to query the web service with their credentials and get files/sub-folders of any folder by ID (metadata only, not contents). This affects Apache OpenMeetings from 3.10 before 9.0.0; users should upgrade to 9.0.0.