CVE Vulnerability Catalog

A vulnerability in the mcp-markdownify-server package before version 1.0.0 allows unauthorized access to files and directories on the server via the get-markdown-file tool. An attacker can craft a malicious prompt that, when processed by the MCP host, enables reading arbitrary files from the system.

Dell PowerStore, version(s) 4.0.0.0, contain(s) an Use of Hard-coded Credentials vulnerability in the PowerStore image file. A low privileged attacker with remote access, with the knowledge of the hard-coded credentials, could potentially exploit this vulnerability to gain unauthorized access based on the hardcoded account's privileges.

In GNU Coreutils, the begfield() function in the sort utility is vulnerable to a heap buffer under-read. A crafted command using the traditional key format may access memory outside the allocated buffer.

A critical vulnerability has been found in GNU Binutils up to 2.44, affecting the function debug_type_samep in /binutils/debug.c of the objdump component. The manipulation leads to memory corruption. Local access is required, and the exploit has been publicly disclosed and may be used.

Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks. This was fixed in Firefox 139 and Thunderbird 139.

A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. This vulnerability was fixed in Firefox 139, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11.

Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks. This vulnerability was fixed in Firefox 139, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11.

The 'Copy as cURL' feature in Firefox for Windows improperly escapes the ampersand character, which could allow an attacker to trick a user into using a crafted command, potentially leading to local code execution on the user's system. This bug only affects Firefox for Windows; other versions are unaffected. Fixed in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11.

Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability was fixed in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11.

Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. This vulnerability was fixed in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11.

A critical vulnerability was found in GNU Binutils up to 2.44 in the elf_gc_sweep function of bfd/elflink.c in the ld component. Manipulation leads to memory corruption. The attack must be approached locally, and the exploit has been disclosed to the public and may be used.

A Cross Site Scripting (XSS) vulnerability in Jeppesen JetPlanner Pro version 1.6.2.20 allows a remote attacker to execute arbitrary code in the victim's browser.

Opening specially crafted URLs in Firefox for iOS from other apps such as Safari could have allowed attackers to spoof website addresses if the URLs utilized non-HTTP schemes used internally by the Firefox iOS client. This vulnerability was fixed in Firefox for iOS 139.

A vulnerability was found in the libsoup library due to its failure to correctly verify the termination of multipart HTTP messages. This allows a remote attacker to send a specially crafted multipart HTTP body, causing an out-of-bounds read.

A resource leak was found in the Linux kernel's blk_register_queue() function error path. When queue registration succeeds for blk_mq_sysfs_register() but a later error occurs, the missing blk_mq_sysfs_unregister() call causes a memory leak.

In the Linux kernel's MTK PMIC keys driver (mtk-pmic-keys), a null pointer dereference vulnerability was found. The issue occurs when a button is not defined in the device tree (e.g., left floating), causing the code to access an uninitialized regs pointer.

A bug was found in the Linux kernel PHY driver for phylink-managed network interfaces. During system resume from suspend, the PHY state machine is not properly stopped, triggering a WARN_ON warning and potentially incorrect operation. The issue affects DSA drivers and other network drivers using phylink that do not set the mac_managed_pm flag.

A memory leak was found in the Linux kernel's lan743x driver. When GSO is enabled and the fragment count is zero, the skb is mapped to the EXT descriptor instead of the LS descriptor, preventing its deallocation.