CVE Vulnerability Catalog

Nezha versions 2.0.0 before 2.4.0 contain a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats. An authenticated user can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned service_histories rows that crash the non-TSDB dashboard on its next startup until removed manually.

NodeBB versions 1.18.0 through 4.16.5 contain an authorization bypass vulnerability allowing unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/complete interstitial to clear a victim's email and confirmation state and revoke all their sessions.

GStreamer's gst-plugins-base MicroDVD subtitle parser contains a NULL pointer dereference flaw. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when a user opens or plays media with a malformed MicroDVD (.sub) subtitle file.

A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause integer overflow in the parser, resulting in incorrect length values being used during stream processing, which can lead to a denial of service.

A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of partially allocated internal structures after a parse failure. This can cause the application using GStreamer to crash, resulting in a denial of service.

A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range value for the number of palette predictor entries. This causes the parser to write beyond the end of a fixed-size array, resulting in memory corruption and an application crash. Successful exploitation requires an attacker to provide a malformed H.265 media file to a vulnerable application, and is limited to a denial-of-service impact.

Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list. To remediate this issue, users should upgrade to version 1.0.8 or later, rotate any long-term IAM user keys, revoke active role sessions where needed, and restrict or redact log data written by an affected version. 0.x users should migrate to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later.

Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions.

Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.

Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions.

Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.

Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions.

Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versions.

The YITH WooCommerce Product Add-Ons plugin in versions up to 4.34.0 contains an unauthenticated bypass vulnerability. The description does not specify the mechanism, but indicates a bypass flaw exploitable without authentication.

The Arraytics Booktics plugin in versions up to 1.0.31 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. The issue affects all versions from the start through 1.0.31.

The Meow Gallery plugin for WordPress is vulnerable to stored cross-site scripting via Attachment Alt Text (aria-label attribute) in all versions up to and including 5.5.1 due to insufficient input sanitization and output escaping. An authenticated attacker with author-level access or above can inject arbitrary scripts that execute when a user accesses an injected page.

Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.

The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 5.5.4 because it does not properly verify that a user is authorized to perform an action. An authenticated attacker with author-level access or above can enumerate and read metadata of all private and draft posts, including post ID, title, date, author, and status.

Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling target endpoint files to run JavaScript in the Mythic UI origin by planting HTML in .pdf-named files. When an operator downloads the file and clicks Preview Media, content-sniffed HTML from /direct/view renders same-origin, stealing localStorage JWTs for full GraphQL and REST access.

changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController. Attackers can enumerate hashid post IDs, sequential newsletter slugs and integer news IDs against preview endpoints to read draft posts, unsent newsletters and declined news items.