CVE Vulnerability Catalog

A vulnerability was found in clientst0r up to version 3.17.586 in the _fetch_html function of locations/services/property_url_importer.py (Property URL Importer component). Manipulation of the url argument results in server-side request forgery, and the exploit has been made public and can be launched remotely.

A flaw was found in GIMP where importing a crafted SBZ palette without a color-model attribute causes a NULL pointer dereference during string comparison. This results in denial of service of the GIMP application.

A vulnerability was detected in clawhost up to version 0.0.45 in the handleRequest function of apps/clawhostgo/src/main/services/reverseProxy.ts (Reverse Proxy component). Manipulation of the token argument results in open redirect, the attack can be initiated remotely, and the exploit is now public.

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv. A decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references, so a filter that removes the last single-key filter frees the callback table while the decode is in progress.

In the Cpanel::JSON::XS Perl library (versions 4.33 to 4.80), duplicate non-ASCII bare keys are not detected, leading to type confusion under dupkeys_as_arrayref in decode_hv. A repeated key replaces the earlier value, and a further repeat may treat the value as an array and dereference a pointer from a JSON number.

Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability allowing remote attackers to impersonate the trusted address bar by entering fullscreen mode via the Fullscreen API without a persistent notification or trusted-origin indicator. After a single user tap, attackers can render a counterfeit address bar showing a trusted origin over attacker-controlled content.

GPAC Project/MP4Box version 2.5-DEV-rev1593-gfe88c3545-master contains a heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c). An attacker can supply a crafted AC4 file to cause a denial of service (DoS).

Element X iOS before version 26.05.0 fails to check the URL allowlist when parsing io.element.call:// URLs. If an attacker tricks a user into opening a maliciously crafted io.element.call:// URL, they can load an attacker-controlled origin inside the call screen's WKWebView, which is granted device microphone and camera permissions (if previously granted to the app).

IBM Cloud Pak System 2.3.6.0 and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code that, when viewed, is executed in the victim's web browser within the security context of the hosting site.

IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.

IBM Concert 1.0 through 3.0.0 allows web page cache to be stored locally, which can be read by another user on the system.

IBM Concert 1.0 through 3.0.0 allows information disclosure through exposure of schema suggestions.

IBM Cloud Pak System 2.3.6.0 and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

IBM Concert versions 1.0 through 3.0.0 is vulnerable to information disclosure via heap inspection. The flaw may allow leakage of data from application memory.

TickTick Android application (com.ticktick.task) 8.2.2.0 contains a path traversal vulnerability in its exported ShareReceiveActivity. A malicious local application can write files outside the intended attachment directory by supplying a crafted content:// URI with a traversal filename via ACTION_SEND intents.

A security vulnerability has been detected in grandnode grandnode2 up to 2.3.0, affecting the function ProductImportDataObject.PrepareProductPictures of the Excel Import component. Manipulation of the Picture1/Picture2/Picture3 arguments leads to path traversal, and the attack can be initiated remotely.

A weakness has been identified in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System up to 3.5, affecting the file /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx of the Upload Endpoint component. Manipulation of the NewFile argument can lead to cross-site scripting, and the attack can be launched remotely.

Hono is a web application framework supporting any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix, leading to unauthorized disclosure of a static file.

A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.

A segmentation violation in the dump_isom_saps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.