CVE Vulnerability Catalog

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, and 10.11.x <= 10.11.10 fail to sanitize client-supplied post metadata. An authenticated attacker can spoof permalink embeds impersonating other users via crafted PUT requests to the post update API endpoint.

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to limit the size of responses from integration action endpoints. An authenticated attacker can cause server memory exhaustion and denial of service via a malicious integration server returning an arbitrarily large response when a user clicks an interactive message button.

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, and 10.11.x <= 10.11.10 fail to bound memory allocation when processing PSD image files, allowing an authenticated attacker to cause server memory exhaustion and denial of service by uploading a specially crafted PSD file.

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate User-Agent header tokens. An authenticated attacker can cause a request panic via a specially crafted User-Agent header.

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, and 10.11.x <= 10.11.10 fail to bound memory allocation when processing DOC files. An authenticated attacker can upload a specially crafted DOC file to exhaust server memory.

Wersje Samsung Account przed 15.5.01.1 zawierają lukę w przekierowaniu URL, która może umożliwić lokalnym atakującym uzyskanie tokena dostępu.

ZKTeco ZKBioSecurity 3.0 contains a local authorization bypass vulnerability in visLogin.jsp that allows attackers to authenticate without valid credentials by spoofing localhost requests.

ZKTeco ZKBioSecurity 3.0 contains a file path manipulation vulnerability that allows attackers to access arbitrary files by modifying file paths used to retrieve local resources.

ZKTeco ZKBioSecurity 3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking logged-in users into visiting malicious websites. Attackers can craft HTTP requests that add superadmin accounts without validity checks, enabling unauthorized administrative access.

ZKTeco ZKBioSecurity 3.0 contains multiple reflected XSS vulnerabilities that allow attackers to execute arbitrary HTML and script code by injecting malicious payloads through unsanitized parameters in multiple scripts.

A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.

OneUptime prior to 10.0.24 logs the complete password reset URL — containing the plaintext reset token — at INFO log level, which is enabled by default in production. Anyone with access to application logs can intercept reset tokens and perform account takeover on any user.

Missing Authorization vulnerability in E2Pdf e2pdf allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects e2pdf from n/a through <= 1.28.15.

Serwer OpenSSL TLS 1.3 może nie negocjować preferowanej grupy wymiany kluczy, gdy jego konfiguracja grupy wymiany kluczy zawiera domyślną wartość 'DEFAULT'. W wyniku tego może być używana mniej preferowana grupa, nawet jeśli zarówno klient, jak i serwer obsługują bardziej preferowaną grupę.

Erlang OTP SSH (ssh_transport module) advertises legacy zlib compression by default, allowing a decompression bomb attack pre-authentication. Each SSH packet can decompress ~255 MB from 256 KB of data (1029:1 ratio), leading to memory exhaustion and DoS. Affects OTP from 17.0 before 28.4.1, 27.3.4.9, and 26.2.5.18.

The ssh_sftpd module in Erlang OTP before OTP 28.4.1, 27.3.4.9, and 26.2.5.18 uses string prefix matching instead of proper path component validation. Authenticated users can access sibling directories that share a common name prefix with the configured root directory.

Uncontrolled Resource Consumption vulnerability in hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of service for package publishing and potentially other package-processing functionality. This issue affects hex.pm before 2026-03-10.

A container privilege escalation vulnerability was found in Multi-Cloud Object Gateway Core images. The issue is caused by the /etc/passwd file being created with group-writable permissions during build time. An attacker with command execution access inside the container, even as a non-root user, can exploit membership in the root group to modify /etc/passwd and add a user with arbitrary UID, including 0, leading to full root privileges.

W niektórych obrazach Fuse odkryto lukę umożliwiającą eskalację uprawnień w kontenerze. Problem wynika z pliku /etc/passwd, który jest tworzony z uprawnieniami do zapisu dla grupy podczas budowy, co pozwala atakującemu na modyfikację tego pliku.

Mechanizm uwierzytelniania w module EasyShare zawiera podatność. W przypadku spełnienia określonych warunków w lokalnej sieci, może dojść do wycieku danych.