CVE Vulnerability Catalog

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing crashes or code execution.

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code.

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage scanline size, so placing or importing it crashes Scribus and may execute code as the user.

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap out-of-bounds write vulnerability in the scimgdataloader_psd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code execution as the user.

In SOCFortress CoPilot prior to 0.1.77, the Velociraptor Sigma exclusion-management endpoints omit role and tenant authorization, and the exclusion creation endpoint does not properly validate credentials — any invalid, expired or forged Bearer token can create a suppression rule. Additionally, rules with a null customer_code apply across all tenants, and low-privilege users can list, modify, disable or delete exclusions.

In SOCFortress CoPilot prior to 0.1.76, the POST /api/agent_data_store/upload endpoint allows customer_user callers to choose bucket_name and object_name without an allowlist, tenant prefix, or ownership check. This enables overwriting objects belonging to any tenant, including sysmon configs, report templates, and case evidence. The issue is fixed in version 0.1.76.

In libass prior to 0.17.5, wrap_lines_measure can overread and overwrite the glyph array while rendering malicious ASS content. In certain wrap modes, a line ending with a literal backslash-n sequence can cause the measurement loops to overshoot by one glyph, leading to an uninitialized read and an out-of-bounds write. The issue is fixed in version 0.17.5.

In libass from 0.17.4 until 0.17.5, event pruning does not guard against negative Matroska ReadOrder values, allowing an attacker to clear bits at attacker-controlled positions near the NULL pointer. Exploitation requires a malicious Matroska stream, enabled read-order checking, and later pruning of malicious events. The issue is fixed in version 0.17.5.

In Chamilo LMS prior to 2.0.1, career.lib.php and import_csv.php call PHP's native unserialize() on user_career.extra_data from the database without the allowed_classes: false option. An attacker able to write crafted serialized PHP objects can trigger POP gadget chains in Symfony, Doctrine, or Monolog components, leading to arbitrary OS command execution. The issue is fixed in version 2.0.1.

In Chamilo LMS from 2.0.0 until 2.0.1, GET /user/{username} is anonymously reachable and renders six user-editable profile fields inside {% autoescape false %} without server-side sanitization. A ROLE_STUDENT attacker can plant HTML in their profile that executes in the browser of any visitor, including administrators. The issue is fixed in version 2.0.1.

An improper access control vulnerability exists in the MFA functionality of ManageEngine SharePoint Manager Plus (SPMP). A low-privileged authenticated user can bypass authorization checks to read and modify MFA settings, enable or disable MFA, enumerate MFA-enrolled users, and delete MFA-enrolled accounts. The issue is fixed in build 4507.

A stored XSS vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript into attributes used to generate charts, including users' full names, site names, or group names. The injected content is stored and executed in other users' browsers when charts are rendered. The issue is fixed in build 4508.

Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via /api/v1/auth/login to modify library and configuration settings and install JavaScript plugins running in QuickJS.

CoreShop by CoreUnion through 1.5.5 contains an unauthenticated SQL injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind techniques to extract member accounts and orders.

CoreShop through 1.5.5 contains an unauthenticated SQL injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind techniques to extract member accounts and orders.

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign themselves the administrator role and gain full control of the instance.

Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete().

DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require_once. Attackers can supply path traversal sequences ../../ to include arbitrary local files outside the intended payment directory, potentially achieving local file disclosure. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

Dell OpenManage Enterprise versions prior to 4.8.0 contain an authentication bypass by spoofing vulnerability. An unauthenticated attacker with adjacent network access could exploit it, leading to session theft.

Dell OpenManage Enterprise versions prior to 4.8.0 contain an OS command injection vulnerability. A low-privileged attacker with remote access could exploit it, leading to command execution.