CVE Vulnerability Catalog

A vulnerability was found in Portabilis i-Diario 1.5.0. It is an XSS in the file /diario-de-observacoes/ of the Observações component. Manipulating the Descrição argument allows remote attack. The exploit is public and a patch is available.

A vulnerability in the Linux kernel's ksmbd component (SMB/CIFS server) allows bypassing a security control that introduces a 5-second delay during session setup to prevent dictionary attacks. This bypass can be achieved through the use of asynchronous requests.

Moby (Docker Engine) releases before 28.0.0 are affected by a firewalld vulnerability. When firewalld reloads, Docker fails to re-create iptables rules isolating bridge networks, allowing any container to access all ports on any other container across different bridge networks on the same host. Only containers in --internal networks remain protected.

In the netavark package, a network stack for containers used with Podman, the dns.podman search domain was removed. As a result, a container may use the host's resolv.conf, and if one of the search domains contains a hostname matching the container's name, DNS queries may be forwarded to external servers.

A vulnerability has been found in GNU Binutils 2.44 in the function bfd_elf_get_str_section of the file bfd/elf.c of the BFD Library component. The manipulation leads to null pointer dereference. The attack requires local access, and the exploit has been publicly disclosed.

A vulnerability was found in libssh involving an uninitialized variable in the privatekey_from_file() function. It is triggered when the specified file does not exist, potentially leading to signing failures or heap corruption.

In Linksys EA6350 V2.1.2, the chroot_local_user option is enabled in the dynamically generated vsftpd configuration file. This could lead to unauthorized access to system files, privilege escalation, or use of the compromised server as a pivot point for internal network attacks.

Portabilis i-Diario 1.5.0 has a cross-site scripting (XSS) vulnerability in the /justificativas-de-falta file via manipulation of the Justificativa argument. The attack can be launched remotely, and the exploit is publicly available.

Portabilis i-Diario 1.5.0 has a cross-site scripting (XSS) vulnerability in the /conteudos file via manipulation of the filter[by_description] argument. The attack can be launched remotely, and the exploit is publicly available.

Portabilis i-Diario 1.5.0 has a cross-site scripting (XSS) vulnerability in the app/uploaders/doc_uploader.rb file via manipulation of the Anexo argument. The attack can be launched remotely, and the exploit is publicly available.

Thor before 1.4.0 can construct an unsafe shell command from library input. NOTE: this is disputed by the Supplier because "the method that was fixed can only be used with arguments that are controlled by Thor, and there is no way an attacker can take control of those arguments."

Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API.

An SSRF vulnerability in JGM Pandoc v3.6.4 allows attackers to inject a crafted iframe, gaining access to and compromising the entire infrastructure. Pandoc's default behavior of fetching and parsing untrusted HTML can facilitate exploitation of this flaw.

A vulnerability in Qt's QColorTransferGenericFunction causes a denial of service when passing values outside the expected range, e.g., when processing a specially crafted ICC profile via QColorSpace::fromICCProfile. Affects Qt from 6.6.0 through 6.8.3 and from 6.9.0 through 6.9.1; fixed in 6.8.4 and 6.9.2.

In FNKvision FNK-GU2 up to 40.1.7, a vulnerability was found in an unknown functionality of the /etc/shadow file in the MD5 component. The manipulation leads to use of a risky cryptographic algorithm; the attack requires physical access and is difficult to exploit, and the exploit has been publicly disclosed.

A vulnerability in Sudo before version 1.9.17p1 allows listed users in the sudoers file to execute commands on unintended machines when the file specifies a host that is neither the current host nor ALL.

A logic flaw was found in the GIF parser of GdkPixbuf's LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output size to the full buffer length instead of the actual number of written bytes. This causes uninitialized buffer sections to be included in the output, potentially leaking arbitrary memory contents in the processed image.

Insufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable afterwards. The default sign_out/2 that AshAuthentication.Phoenix.Controller injects into an application's auth controller only calls Plug.Conn.clear_session/1. It never revokes the stored session or bearer tokens, so a token obtained before sign-out, through script injection, interception or device theft, keeps authenticating until its own expiry. Changing the password still revokes it.

Wykryto podatność w GNU ncurses do wersji 6.5-20250322, klasyfikowaną jako problematyczną. Dotyczy ona funkcji postprocess_termcap w pliku tinfo/parse_entry.c i prowadzi do przepełnienia bufora na stosie.

A vulnerability, which was classified as problematic, has been found in TOTOLINK T10 4.1.8cu.5207. Affected by this issue is some unknown functionality of the file /etc/shadow.sample. The manipulation leads to use of hard-coded password. The attack can only be initiated within the local network. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.