CVE Vulnerability Catalog

An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifier, scores, lesson status, lesson position, and cached lesson state via the SCORM API endpoint.

An unauthenticated attacker can forcibly terminate the session of any Koollab LMS user by knowing their email address via the login kickout endpoint, leading to denial of service.

An authenticated attacker can upload malicious content disguised as an image file via the feedback mail registration endpoint in Koollab LMS due to unrestricted image upload.

In datamodel-code-generator prior to version 0.63.0, the get_body function reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, potentially leaking credentials to external servers. This issue has been fixed in version 0.63.0.

The sqlite3 Ruby bindings for SQLite3 from version 2.1.0 to 2.9.4 contain a use-after-free vulnerability in callbacks used for SQLite aggregate functions. Callbacks can be freed while still referenced during aggregation, leading to memory corruption.

The sqlite3 Ruby bindings for SQLite3 in version 2.9.4 and earlier contain a use-after-free vulnerability when redefining a SQLite function with a different arity. The previously registered function handler is freed while SQLite may still reference it, leading to memory corruption.

The tiny-http library up to version 0.12.0 has an HTTP header injection vulnerability, allowing attackers to inject CR and LF bytes into header values. Insufficient validation leads to response splitting, cache poisoning, session fixation, and request smuggling.

The `Element.findall()` and `Element.iterfind()` methods in the XML parser have O(n^2) time complexity when using XPath index predicates on documents with many siblings. `Element.find()` is only affected when searching for last matches.

The quick setup view shown to users after creating an event does not properly check user permissions to change configuration for that event. An attacker can use a well-timed request to create products, quotas, set bank transfer configuration, or connect a Stripe account to an event they do not have access to.

In GStreamer's gst-plugins-good, a heap-based out-of-bounds read of 4 bytes occurs when parsing FLAC audio stream headers embedded in Matroska or WebM container files. A boundary check does not account for the full size of the copied data, allowing a small read past the end of the allocated buffer. An attacker can exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it.

Successful exploitation of this vulnerability allows an attacker with local network access to bypass the application's rate-limiting mechanism, enabling brute-forcing of the screen-sharing code and potentially displaying harmful content on the affected screen.

The Quiz and Survey Master (QSM) WordPress plugin before version 11.1.5 does not perform a capability check before deleting output templates. This allows users with contributor-level access and above to delete arbitrary templates.

The Event Tickets and Registration WordPress plugin before version 5.28.4 does not properly escape event titles before outputting them in a ticket history log. This allows users with the Editor role and above to perform Stored Cross-Site Scripting (XSS) attacks that execute against higher-privileged users on multisite installations.

A lock screen issue in macOS fixed with additional restrictions. A person with physical access to a locked device may access contacts and photos.

In Astro versions 8.1.0 through 11.0.1, when trailingSlash: 'always' is configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\ (slash-backslash) were not recognized as internal paths, so the handler would echo the raw path back in the Location header. Because browsers treat \ as / per the WHATWG URL specification, the resulting redirect could resolve to an external host.

In Astro versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered <astro-island> element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS).

In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full interrupt handler gates the write_requested() callback on dw->state != CMD_SEND, and dw->state is only reset to READY on a STOP interrupt. The START_DET interrupt, which would reset the state on every (re)START, was never added to the enabled interrupt mask, so that recovery path was dead code. As a result, if the STOP interrupt is lost or the bus master issues a legal WRITE-repeated-START-WRITE sequence, the driver remains in CMD_SEND permanently and never invokes write_requested() again.

In Papra prior to version 26.5.0, the webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses (loopback, link-local, RFC-1918 ranges). The SSRF protection validates the registered webhook URL but ignores redirect destinations. The HTTP client (ofetch) follows 3xx responses automatically, and the redirect target is never checked against the blocklist.

A vulnerability in ggml-org whisper.cpp (commit 95ea8f9b) in the function ggml_ftype_to_ggml_type in file ggml/src/ggml.c. Manipulation of the ftype argument leads to a reachable assertion. Local access is required. The project has not responded yet.

An information disclosure vulnerability in HCL Connections via a specific endpoint. In certain scenarios, this could lead to sensitive information being disclosed to unauthorized users.