CVE Vulnerability Catalog

A potential vulnerability was reported in the Lenovo FileZ Android application that, under certain conditions, could allow a local authenticated user to retrieve some sensitive data stored in a log file.

The vulnerability allows changing the administrator password without knowledge of the current password. When chained with an authentication bypass vulnerability, it may allow unauthenticated attackers to modify the administrator password.

Easy Grade Pro 4.1.0.2 contains a file parsing logic flaw in handling proprietary .EGP gradebook files. Modifying specific fields at precise offsets triggers an out-of-bounds memory read, causing an application crash.

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.

W wyniku braku sprawdzenia autoryzacji w serwerze aplikacyjnym SAP NetWeaver dla ABAP, uwierzytelniony atakujący mógłby wykonać określony moduł funkcji ABAP i odczytać wrażliwe informacje z katalogu bazy danych systemu ABAP. Podatność ta ma niski wpływ na poufność aplikacji, nie wpływając na integralność i dostępność.

A vulnerability was detected in Mendi Neurofeedback Headset V4. It affects an unknown functionality of the Bluetooth Low Energy Handler. Manipulation results in cleartext transmission of sensitive information. The attack can only be performed from the local network, and its complexity is high, making exploitation difficult.

On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir, the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.

Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited denial-of-service in the Command Centre Server. Affected versions: 9.40 prior to vEL9.40.1976(MR1), 9.30 prior to vEL9.30.3382 (MR4), 9.20 prior to vEL9.20.3783 (MR6), 9.10 prior to vEL9.10.4647 (MR9), and all versions of 9.00 and prior.

Vim is an open-source command-line text editor. Prior to version 9.2.0078, a stack-buffer-overflow occurs in `build_stl_str_hl()` when rendering a statusline with a multi-byte fill character on a very wide terminal. Version 9.2.0078 patches the issue.

A flaw was found in Keycloak's WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.

VLC for Android prior to version 3.7.0 contains an authentication bypass in the Remote Access Server due to missing rate limiting on OTP verification. An attacker with network access can repeatedly attempt to guess the 4-digit OTP until a valid user session cookie is issued.

In Golioth Firmware SDK versions 0.19.1 through 0.21.0, there is an out-of-bounds read vulnerability due to improper null termination of a blockwise transfer path. The blockwise_transfer_init() function copies the path using strncpy() without guaranteeing a trailing NUL byte, leaving the buffer unterminated. A subsequent strlen() call on this buffer can read past the allocated memory, causing a crash or denial of service.

In Golioth Firmware SDK versions 0.10.0 through 0.22.0, there is an out-of-bounds read vulnerability in LightDB State string parsing. When payload_size is less than 2, a size_t underflow occurs when computing the number of bytes to copy, and the subsequent memcpy() reads past the end of the network buffer, potentially crashing the device.

In Golioth Firmware SDK versions 0.10.0 through 0.22.0 (before commit 48f521b), a stack-based buffer overflow exists in Payload Utils. The golioth_payload_as_int() and golioth_payload_as_float() helpers copy network-supplied payload data into fixed-size stack buffers using memcpy() with a length derived from payload_size, with length checks only guarded by assert() which are compiled out in release builds. Payloads larger than 12 bytes (int) or 32 bytes (float) can overflow the stack, causing a crash/denial of service.

A TOCTOU vulnerability allows recently deleted-then-recreated data sources to be re-deleted without proper permissions.

Erlang/OTP has a relative path traversal vulnerability in the tftp_file modules, allowing access to files outside the intended directory. This affects OTP versions from 17.0 before 28.3.2, 27.3.4.8, and 26.2.5.17.

The Go library filippo.io/edwards25519 in versions 1.1.0 and earlier has a flaw in MultiScalarMult that produces invalid results or undefined behavior when the receiver is not the identity point. Version 1.1.1 fixes the issue.

Mattermost versions 10.11.x <= 10.11.9 fail to enforce invite permissions when updating team settings. Team administrators without proper permissions can bypass restrictions and add users to their team via API requests.

Improper Certificate Validation vulnerability in Thales SafeNet Agent for Windows Logon on Windows allows Signature Spoofing by Improper Validation. This issue affects SafeNet Agent for Windows Logon: 4.0.0, 4.1.1, 4.1.2.

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.