CVE Vulnerability Catalog

A cross-site scripting vulnerability was detected in SourceCodester Online Quiz System up to version 1.0 in an unknown functionality of endpoint/add-question.php. Manipulating the quiz_question argument results in script injection. The attack can be initiated remotely and a public exploit is available.

A cross-site scripting (XSS) vulnerability was detected in the Online Reviewer System up to version 1.0. Manipulation of the Description argument in /system/system/students/assessments/databank/btn_functions.php allows a remote attack, and a public exploit is already available.

A cross-site scripting vulnerability was identified in code-projects Social Networking Site 1.0 in the file /home.php within the Alert Handler component due to manipulation of the content argument. Remote exploitation is possible and the exploit is publicly available.

A vulnerability has been found in OpenBMB XAgent 1.0.0. The ReplayServer.on_connect/ReplayServer.send_data functions in XAgentServer/application/websockets/replayer.py of the WebSocket Endpoint component, when manipulating the interaction_id argument, lead to authorization bypass. The attack may be launched remotely, is highly complex, and the exploit has been publicly disclosed.

Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed heap data by sending specially crafted input. This can trigger a denial of service condition, resulting in low availability impact to the authentication daemon.

A flaw was found in OpenBMB XAgent 1.0.0 in the FunctionHandler.handle_tool_call function in XAgent/function_handler.py, related to API key handling. Manipulation of the api_key argument causes sensitive information to be exposed in log files. The exploit has been publicly disclosed, and the vendor did not respond.

If auth_username_chars is empty, it is possible to inject an arbitrary LDAP filter into Dovecot's LDAP authentication. This may bypass restrictions and allow probing of the LDAP structure. No publicly available exploits are known.

A flaw was found in libssh in which a malicious SFTP server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap, causing unexpected behavior or denial of service (DoS) due to application crashes.

A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt normal operations.

Mattermost Plugins versions <=11.4 and 10.11.11.0 fail to validate webhook request timestamps, allowing an attacker to corrupt Zoom meeting state in Mattermost via replayed webhook requests.

A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter during refresh token requests. This occurs when a Keycloak client is configured to use the `backchannel.logout.url` with the `application.session.host` placeholder.

A local attacker may gain access to the user's Keychain items due to insufficient permissions checking. The issue was fixed in multiple versions of iOS, iPadOS, macOS, visionOS, and watchOS.

Action View provides conventions and helpers for building web pages with the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS.

A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration.

The webbrowser.open() API in Python would accept URLs starting with dashes, which could be interpreted as command line options by certain web browsers. The new behavior rejects such URLs.

Mattermost versions 10.11.x <= 10.11.10 fail to validate the user's authentication method when processing an account auth type switch. An authenticated attacker can change the account password without confirmation by falsely claiming a different auth provider.

In libexpat before version 2.7.5, a NULL pointer dereference occurs in the setContext function on retry after a previous out-of-memory condition.

Malformed ATAES132A responses with an oversized length field overflow a 52-byte stack buffer in the Zephyr crypto driver, allowing a compromised device or bus attacker to corrupt kernel memory and potentially hijack execution.

Moduł tarfile w Pythonie błędnie normalizował bloki AREGTYPE (\x00) do DIRTYPE podczas przetwarzania wieloblokowych członków archiwum, takich jak GNUTYPE_LONGNAME lub GNUTYPE_LONGLINK. Może to prowadzić do błędnej interpretacji spreparowanego archiwum tar w porównaniu z innymi implementacjami.

A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.