CVE Vulnerability Catalog

The vulnerability affects ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext, which can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages.

A vulnerability in OpenSSL CMP response validation passes an unexpected response sender distinguished name directly as a format string to ERR_raise_data(). An attacker can craft a sender DN with percent characters, causing a crash of the CMP client. This occurs when the client enforces an expected sender or uses a pinned server certificate.

NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer._execute and numpy.f2py.crackfortran.myeval through pickle REDUCE to execute arbitrary commands during model or tokenizer artifact loading.

Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevated privileges.

A path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to execute arbitrary code on an affected system.

SSRF vulnerability in Apache Hive before 4.2.1 allows an authenticated attacker with CREATE TABLE privilege to force the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url property for an Avro table. This can expose cloud instance metadata, internal network services, or local server files to the Hive process identity.

SQL injection vulnerability in Apache Hive before 4.2.1 affects partition-name resolution in Hive Metastore when direct SQL is enabled. An authenticated user can craft partition names in RPC requests to alter the WHERE clause, allowing read, modification, or impact on metadata of unintended partitions (e.g., statistics updates, truncate targets, file-metadata cache operations).

The extension fails to safely process untrusted client input from an attacker-controlled cookie directly into PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.

The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute arbitrary Fluid ViewHelpers leading to disclosure of server configuration, environment variables and application source, and potentially remote code execution. Exploitation requires only that a form field is configured as the sender_name field, a common and default-adjacent Powermail configuration. No authentication or user interaction beyond a normal form submission is required. This vulnerability is reported to be actively exploited in the wild.

The web-based management interface uses a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username, taken directly from the Authorization header without sanitization, is inserted into a shell command string executed via the system() function. By submitting a specially crafted username containing shell metacharacters, an unauthenticated attacker with network access to the device can escape the command context and execute arbitrary commands with root privileges.

FA-50 all versions contain hard-coded credentials. An attacker, who knows the credentials and has access to the vessel's internal network, can operate the settings screen using those credentials to alter the identification number.

The OCPP 1.6 client contains a stack buffer overflow in parse_getconfig_msg(). An attacker controlling the central system or performing a man-in-the-middle attack can send a GetConfiguration request with a key longer than 50 bytes, causing a stack overflow in the reader thread.

NLTK before 3.10.0 contains an unsafe pickle deserialization vulnerability in TransitionParser.parse(). Deserialization uses default restricted=False, allowing arbitrary Python code execution when loading a crafted model file.

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, potentially turning dormant quoted values into active directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live after any GitPython config write, enabling arbitrary code execution.

Grav Login plugin before 1.0.16 fails to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the highest-privilege accounts.

Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution.

Unauthenticated Privilege Escalation in TranslatePress versions up to 3.3.2.

Unauthenticated PHP Object Injection in The Events Calendar versions up to 6.17.2.

Unauthenticated PHP Object Injection in WP Project Manager versions up to 4.0.6.

A vulnerability in CakePHP Authentication plugin (versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0) allows authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. Fixed in versions 2.11.2, 3.3.7, and 4.2.1.