CVE Vulnerability Catalog

Pillow from 9.1.0 until 13.0.0 can disclose uninitialized stack memory when Image.quantize() uses an empty palette. ImagingPaletteCacheUpdate() leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as output pixel indices in a returned PNG or GIF.

In Pillow from 5.3.0 until 13.0.0, the library can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The _decodeStrip and _decodeTile buffers can be larger than the bytes written by libtiff, and Pillow does not clear the unwritten tail. An attacker can supply a crafted TIFF to an application that loads and returns or re-encodes its pixels.

Pillow from 11.3.0 until 13.0.0 has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. The error path frees the output buffer without closing the TIFF handle, and later cleanup flushes through the write callback into freed memory.

Dolibarr up to 23.0.2 contains a vulnerability in an unknown function of htdocs/document.php in the CSP component. Manipulation leads to protection mechanism failure, and the attack can be executed remotely.

TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537 contains a vulnerability in the get_img_from_url function of ApiBillet/serializers.py in the APIv1 component. Manipulation of the img_url/image_url argument can lead to server-side request forgery, and the attack can be launched remotely.

TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to be applied inconsistently, allowing protected camera operations to be executed without a valid authenticated session.

The UpdateHub firmware-over-the-air client in Zephyr parses the CoAP probe response with the JSON library, which treats every descriptor field as optional. When the response omits the "sha256sum" field, the corresponding pointer stays NULL and the code calls strlen() on it before any validation, causing a read at address zero. Because the metadata is supplied entirely by the network peer (plain CoAP over UDP by default, without DTLS), an attacker can trigger the fault remotely.

Pillow from 8.2.0 until 13.0.0 can read past the tile buffer while copying four-byte pixels in the tiled-TIFF decoder. In _decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-copy loop walks beyond that allocation.

kiwilan php-archive up to 2.3.02 has a path traversal vulnerability in ArchiveZip::extract in src/Readers/ArchiveZip.php. The attack can be carried out remotely and a public exploit is available.

DiffSK configobj up to 5.0.9 has an inefficient regular expression complexity vulnerability in _sectionmarker in configobj/__init__.py. Remote exploitation is possible.

smrealms smr up to commit f40380c has a server-side request forgery vulnerability in isUrlReachable in src/pages/Account/AlbumEditProcessor.php via the Website argument. The attack can be launched remotely and the exploit is publicly disclosed.

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the file_etag option is not set, the ETag is built from the file's inode number, modification time and size.

Grav from 2.0.0 before 2.2.2 allows page editors to read protected configuration by adding config-*@ directives to page frontmatter forms. Attackers with page-edit permission can bypass the Twig sandbox config_denied_paths redaction to expose security.salt, plugin credentials, and Redis passwords to all visitors.

Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contain a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue() without consulting the sandbox security policy. Authenticated Control Panel users can supply dot-path keys to traverse the craft global and disclose the securityKey, database credentials, and auth tokens.

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, when passwordPolicy.maxPasswordHistory or doNotAllowUsername is set, guessed current or previous passwords, bypassing account lockout.

ptbsare anx-calibre-manager up to 1.13.12 has a server-side request forgery vulnerability in LLMClient.chat in blueprints/api/llm.py via the base_url argument. The attack can be initiated remotely and the exploit has been published.

A vulnerability was found in clientst0r up to version 3.17.586 in the _fetch_html function of locations/services/property_url_importer.py (Property URL Importer component). Manipulation of the url argument results in server-side request forgery, and the exploit has been made public and can be launched remotely.

A flaw was found in GIMP where importing a crafted SBZ palette without a color-model attribute causes a NULL pointer dereference during string comparison. This results in denial of service of the GIMP application.

A vulnerability was detected in clawhost up to version 0.0.45 in the handleRequest function of apps/clawhostgo/src/main/services/reverseProxy.ts (Reverse Proxy component). Manipulation of the token argument results in open redirect, the attack can be initiated remotely, and the exploit is now public.

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv. A decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references, so a filter that removes the last single-key filter frees the callback table while the decode is in progress.