CVE Vulnerability Catalog

A flaw was found in the libxml2 library where uncontrolled resource consumption occurs when processing XML catalogs with repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing redundant traversal of catalog chains.

A flaw was found in the RelaxNG parser of libxml2 related to handling external schema inclusions. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives, which can cause excessive recursion. Specially crafted schemas may lead to stack exhaustion and application crashes.

A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable.

A defective masking feature in the TeamViewer entry dashboard component of Devolutions Remote Desktop Manager 2025.3.24.0 through 2025.3.28.0 on Windows allows an external observer to view a password on screen, for example during physical observation or screen sharing.

During SSH-based transfers using SCP or SFTP, when public key authentication is requested, curl incorrectly asks and authenticates using a locally running SSH agent.

A cross-site scripting vulnerability was detected in projectworlds House Rental and Property Listing version 1.0 in unknown processing of /app/complaint.php. Manipulating the Name argument results in script injection. The attack can be launched remotely and a public exploit is available.

Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability via exposure of administrative services bound to external network interfaces instead of the local authentication interface.

Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests.

Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods.

A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.1. Affected by this vulnerability is an unknown functionality of the file rockfun.php of the component API. This manipulation of the argument callback causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A security flaw has been discovered in Xinhu Rainrock RockOA up to 2.7.1. An unknown function of rock_page_gong.php, within the Cover Image Handler component, is affected. Manipulation of the fengmian argument results in cross site scripting, the attack can be launched remotely, and the exploit has been released publicly.

The FlexTable WordPress plugin before 3.19.2 does not sanitise and escape the imported links from Google Sheet cells, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

A vulnerability was detected in zhanglun lettura up to 0.1.22. This issue affects the RSS Handler component in src/components/ArticleView/ContentRender.tsx, leading to cross site scripting. The attack can be executed remotely but is characterized by high complexity and difficulty. The exploit is public and a patch is available.

A vulnerability in xnx3 wangmarket up to 4.9, affecting the function variableList in the file /admin/system/variableList.do of the Backend Variable Search component. Manipulation of the Description argument leads to cross-site scripting (XSS). The attack can be launched remotely. The exploit has been made public.

A vulnerability in xnx3 wangmarket up to 4.9, affecting an unknown function in the file /admin/system/variableSave.do of the System Variables Page component. Manipulation of the Description argument leads to cross-site scripting (XSS). The attack can be initiated remotely. The exploit has been released publicly.

A generation of error message containing sensitive information vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access, they can exploit the vulnerability to read application data. The vulnerability has been fixed in version 26.2.0.938 and later.

A vulnerability was found in LigeroSmart up to 6.1.24 in the Environment Variable Handler component, where manipulation of the REQUEST_URI argument results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 6.1.26 or 6.3 mitigates this issue.

A weakness has been identified in Open5GS up to 2.7.6 in the function sgwc_s5c_handle_create_session_response of the file src/sgwc/s5c-handler.c of the GTPv2-C Flow Handler component. The manipulation can lead to denial of service. The attack requires local access, and the exploit is publicly available.

A security flaw has been discovered in Open5GS up to 2.7.6. The function ogs_gtp2_parse_bearer_qos in lib/gtp/v2/types.c of the Bearer QoS IE Length Handler component is affected. Manipulation results in denial of service. The attack must be initiated locally and the exploit has been released to the public.

A vulnerability was identified in Open5GS up to 2.7.6. Affected is the function sgwc_s11_handle_create_session_request of the file src/sgwc/s11-handler.c of the component GTPv2-C F-TEID Handler. Such manipulation leads to denial of service. The attack must be carried out locally. The exploit is publicly available and might be used. The name of the patch is 465273d13ba5d47b274c38c9d1b07f04859178a1. A patch should be applied to remediate this issue.