CVE Vulnerability Catalog

A Cross-Site Request Forgery (CSRF) vulnerability in the WatchGuard Fireware OS WebUI could allow a remote attacker to trigger a denial-of-service (DoS) condition in the Fireware Web UI by convincing an authenticated administrator into visiting a malicious web page.

An Insecure Deserialization vulnerability in WatchGuard Fireware OS allows an attacker with write access to the local filesystem to execute arbitrary code in the context of the portald user. This does not affect Firebox platforms without Access Portal support, including T15 and T35.

WebDrive 18.00.5057 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the username field during Secure WebDAV connection setup. Attackers can input a buffer-overflow payload of 5000 bytes in the username parameter and trigger a connection test to cause the application to crash.

HeidiSQL 9.5.0.5196 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long file path in the logging preferences. Attackers can input a buffer-overflow payload through the SQL log file path field in Preferences > Logging to trigger an application crash.

NetSetMan 4.7.1 contains a buffer overflow vulnerability in the Workgroup feature that allows local attackers to crash the application by supplying oversized input. Attackers can create a malicious configuration file with excessive data and paste it into the Workgroup field to trigger a denial of service condition.

A flaw was found in libsoup that allows sensitive session cookies to be transmitted in cleartext during the establishment of HTTPS tunnels through a configured HTTP proxy. Attackers can intercept these cookies, leading to potential session hijacking or user impersonation.

W jądrze systemu Linux zidentyfikowano podatność, która została naprawiona. Problem dotyczy możliwego wycieku pamięci w wyrażeniu stanowym w ścieżce błędu, gdy klonowanie drugiego wyrażenia stanowego nie powiedzie się.

In the ecdsa PyPI package prior to 0.19.2, remove_octet_string() accepts truncated DER where the declared length exceeds the buffer, causing unexpected exceptions (e.g., IndexError) from public API functions instead of cleanly rejecting malformed DER. This can lead to denial of service in applications parsing untrusted DER private keys.

A vulnerability was identified in the CGIF library up to version 0.5.2, in the cgif_addframe function in src/cgif.c handling GIF images. Manipulation of the width/height arguments leads to an integer overflow. The attack may be initiated remotely and the patch identifier is b0ba830093f4317a5d1f345715d2fa3cd2dab474.

In changedetection.io prior to 0.54.7, the jq: and jqraw: include filters allow use of the jq env builtin, which reads all process environment variables and stores them in the watch snapshot. An authenticated user (or unauthenticated when no password is set, the default) can leak sensitive variables such as SALTED_PASS, PLAYWRIGHT_DRIVER_URL, HTTP_PROXY, and other secrets.

In LinkAce prior to version 2.5.3, a private note attached to a non-private link can be disclosed to a different authenticated user via the web interface. The API correctly enforces note visibility, but the web link detail page renders notes without equivalent filtering.

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the streamable_http_transport.rb implementation contains a session hijacking vulnerability — an attacker who obtains a valid session ID can completely hijack the victim's Server-Sent Events (SSE) stream and intercept all real-time data. Version 0.9.2 contains a patch.

Handlebars versions 4.0.0 through 4.7.8 contain a flaw in resolvePartial() that resolves partial names via plain property lookup on options.partials without guarding against prototype-chain traversal. When Object.prototype is polluted with a string matching a partial reference, the polluted string is used as the partial body and rendered without HTML escaping, leading to XSS. Version 4.7.9 fixes the issue.

Ella Core is a 5G core designed for private networks. Versions prior to 1.7.0 panic when processing Authentication Response and Authentication Failure NAS messages missing IEs. An attacker able to send crafted NAS messages can crash the process, causing service disruption for all connected subscribers. No authentication is required.

Ella Core prior to version 1.7.0 contains a deadlock in the AMF's SCTP notification handler that hangs the entire AMF control plane until the process is restarted. An attacker with access to the N2 interface can cause Ella Core to hang, resulting in a denial of service for all subscribers.

Ella Core, a 5G core designed for private networks, panics when processing a specially crafted NGAP LocationReport message in versions prior to 1.7.0. An attacker able to send such messages can crash the process.

Statamic (a Laravel and Git powered CMS) prior to 5.73.16 and 6.7.2 allows authenticated Control Panel users to view entry revisions for any collection with revisions enabled, regardless of collection permissions. This bypasses authorization checks enforced by the main entry controllers, exposing entry field values and blueprint data. Users could also create entry revisions without edit permission, though this only snapshots existing content state. Fixed in 5.73.16 and 6.7.2.

Statamic, a Laravel and Git powered CMS, from version 5.7.12 and prior to 5.73.16 and 6.7.2 allows a control panel user with access to Antlers-enabled fields to access sensitive application configuration values by inserting config variables into their content. Fixed in 5.73.16 and 6.7.2.

Statamic CMS contains a bypass of the external URL detection used for redirect validation on unauthenticated endpoints. This allows users to be redirected to external URLs after actions such as form submissions and authentication flows. The issue is fixed in versions 5.73.16 and 6.7.2.

Statamic is a Laravel and Git powered CMS. Prior to versions 5.73.16 and 6.7.2, an authenticated Control Panel user with access to live preview could use a live preview token to access restricted content that the token was not intended for. This has been fixed in 5.73.16 and 6.7.2.