CVE Vulnerability Catalog

Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution vulnerability because user-controlled keys are expanded into objects without own-property checks. Clients with class write access can send dot notation field keys or ACL entry names matching built-in object members to corrupt built-in functions, causing all requests to fail until server restart.

A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an uncaught StackOverflowError. An authenticated user with BULK_READ permission who can submit a cache query may trigger the issue, potentially affecting availability.

A flaw was found in GIMP's PSD plug-in: the image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution.

CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header. The cookieConf() function rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter; the same cookie sent in the X-Session-Cookie header is accepted regardless of age.

CallBackery versions before 0.62.0 for Perl allow session cookie forgery due to a signing secret generated with rand(). The secret is built from two calls to the built-in rand(), seeded with 32 bits, so it has at most 2^32 possible values, and one signed cookie is enough to test each candidate offline.

Bitcoin Core prior to 29.5, 30.4, 31.2, and 32.1 is vulnerable to an OOM (out-of-memory) issue. The description does not provide further technical details.

Skuul School Management System through version 2.6.5 is vulnerable to incorrect access control in the ResultChecker::checkResult method. An authenticated student can manipulate the studentId parameter to retrieve another student's examination results, including marks, without authorization.

A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page. The 'tlsErrorPage' script message handler is registered immediately before loading the error page, leaving a brief window where the previously loaded untrusted origin can call postMessage and approve a certificate exception without user interaction.

The Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability. Unauthenticated attackers can submit frontend forms without valid verification by omitting the g-recaptcha-token field in POST requests, because the verify() method returns early on empty token values.

The Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API. A user with Kirki edit access (granted to the Editor role by default) can modify the title, slug, and publication status of any non-trashed post of any post type, including custom post types and WooCommerce products they do not own.

Dell OpenManage Enterprise versions prior to 4.8.0 contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to server-side request forgery.

Dell OpenManage Enterprise versions prior to 4.8.0 contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low-privileged attacker with local access could potentially exploit this vulnerability, leading to protection mechanism bypass.

OpenManage Enterprise versions prior to 4.8.0 contain an Improper Resource Locking vulnerability. A high-privileged attacker with local access could potentially exploit this vulnerability, leading to protection mechanism bypass.

Campfire is a web-based chat application. In version 1.4.4 and earlier, when a Campfire message contains a link, the server fetches it to build an OpenGraph unfurl preview. RestrictedHTTP::PrivateNetworkGuard relied on Ruby's IPAddr#private?, IPAddr#loopback?, and IPAddr#link_local? predicates plus IPv4-mapped and IPv4-compatible checks, which do not cover several special-use ranges. An authenticated user can post a link to a hostname resolving to CGNAT 100.64.0.0/10, NAT64 64:ff9b::/96 or 64:ff9b:1::/48, or 6to4 2002::/16 to bypass the guard and cause server-side requests to internal network resources. The NAT64 and 6to4 ranges can embed an internal IPv4 target. Confidentiality impact is limited to returned OpenGraph metadata, and most internal endpoints return none. There is no integrity or availability impact. An initial fix was released in version 1.4.5.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Input Validation vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution.

DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds. The _normalize_leap_seconds function crosses day boundaries one day at a time, so add(seconds => $n) on an object with a non-floating time zone takes about |$n|/86400 iterations, and nothing limits $n; both the XS implementation and the pure-Perl fallback have the loop.

An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with standard user permissions access a device interface belonging to a privileged kernel driver and send specially crafted requests.

In the mDNS component for ESP-IDF before version 1.11.2, mdns_utils_read_fqdn() follows DNS name-compression pointers recursively without capping depth. An unauthenticated attacker on the same link-local network can send a crafted packet to UDP port 5353 and exhaust the mDNS FreeRTOS task stack, causing a controlled panic and reboot.

CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are hashed with hmac_sha1_sum() from Mojo::Util with no key, no salt and no work factor, so equal passwords give equal hashes and guessing is fast.

Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate. confirm_resource takes no session token from the caller and always accepts the flow, and since version 1.00 a flow with a mandate is returned as confirmed without being completed again.