CVE Vulnerability Catalog

Rollbar.js before version 2.26.5 and from 3.0.0-alpha1 to before 3.0.0-beta5 has a prototype pollution vulnerability in merge(). If application code calls rollbar.configure() with untrusted input, prototype pollution is possible. This has been fixed in versions 2.26.5 and 3.0.0-beta5.

The Frontier Airlines website has a publicly available endpoint that validates if an email address is associated with an account. An unauthenticated, remote attacker could determine valid email addresses, possibly aiding in further attacks.

A container privilege escalation flaw was found in certain Container-native Virtualization images. The /etc/passwd file is created with group-writable permissions during build time, allowing an attacker with non-root access to modify it and add a user with arbitrary UID, including 0, leading to full root privileges within the container.

Liferay Portal versions 7.4.0 through 7.4.3.101 and older unsupported versions, as well as Liferay DXP 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, and older unsupported versions, are vulnerable to self-XSS on the edit Knowledge Base article page. A remote attacker can inject arbitrary script or HTML via a crafted payload in an attachment's filename.

A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload.

NVIDIA Display Driver for Windows and Linux contains a vulnerability in a video decoder that allows an out-of-bounds read. Successful exploitation may lead to information disclosure or denial of service.

NVIDIA Display Driver for Linux contains a vulnerability in a kernel module, where an attacker might be able to trigger a null pointer dereference. A successful exploit of this vulnerability might lead to denial of service.

NVIDIA Display Driver for Linux contains a vulnerability where an attacker might be able to trigger a null pointer dereference. A successful exploit might lead to denial of service.

NVIDIA Display Driver for Linux contains a vulnerability in the kernel driver, where a user could cause a null pointer dereference by allocating a specific memory resource. A successful exploit of this vulnerability might lead to denial of service.

Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 creates a temporary file to store the local authentication token during startup, before copying it to its final location. This temporary file is created in a directory accessible to all users on the system. An unauthorized local user or process can exploit this behavior by placing a file lock on the temporary token file using the flock system call. This prevents MinKNOW from completing the token generation process. As a result, no valid local token is created, and the software is unable to execute commands on the sequencer. This leads to a denial-of-service (DoS) condition, blocking sequencing operations.

Tibbo AggreGate Network Manager before 6.40.05 exposes sensitive system information through an unauthenticated endpoint at /cwmp/happyaxis.jsp. The page discloses Java system properties, server path details, and version information to unauthorized users, resulting in information disclosure that could aid further compromise.

Tibbo AggreGate Network Manager < 6.40.05 contains an observable response discrepancy in its login functionality. Authentication failure messages differ based on whether a supplied username exists or not, allowing an unauthenticated remote attacker to infer valid account identifiers. This can facilitate user enumeration and increase the likelihood of targeted brute-force or credential-stuffing attacks.

FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8.

Enabled serial console could potentially leak information that might help an attacker to find vulnerabilities. This issue affects BLU-IC2 through 1.19.5 and BLU-IC4 through 1.19.5.

In Keycloak, an offline session remains valid when the offline_access scope is removed from the client. The refresh token is still accepted and new tokens can continue to be requested for the session.

Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions do not properly restrict access to OpenAPI in certain circumstances, allowing remote attackers to access the OpenAPI YAML file via a crafted URL.

Vilar VS-IPC1002 IP cameras are vulnerable to DoS (Denial-of-Service) attacks. An unauthenticated attacker on the same local network might send a crafted request to /cgi-bin/action endpoint and render the device completely unresponsive.

Vilar VS-IPC1002 IP cameras are vulnerable to Reflected XSS because parameters in GET requests sent to the /cgi-bin/action endpoint are not properly sanitized, making it possible to target logged-in admin users. The vendor did not respond in any way; only version 1.1.0.18 was tested, other versions might be vulnerable as well.

Cross-site Scripting has been identified in Moxa's Ethernet switches, allowing an authenticated administrative attacker to inject malicious scripts into the device's web service that could impact authenticated users interacting with the web interface. This is stored XSS; scripts persist across sessions. There is no impact to the confidentiality, integrity, and availability of the affected device, but some loss of confidentiality and integrity within subsequent systems.

A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions created while "Remember Me" was active retain their extended session lifetime until they expire, overriding the administrator's recent security configuration change. This logic flaw in session management increases the potential window for successful session hijacking or unauthorized long-term access persistence.