CVE Vulnerability Catalog

F´ (F Prime) before version 4.2.0 has a vulnerability in the Svc::FpySequencer STORE directive stack write validation. The bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound to make an out-of-range destination appear valid.

F´ (F Prime) before version 4.2.0 has a vulnerability in Fw::FilePacket deserialization used by Svc::FileUplink. Header deserialization casts the byte to the Type enum without validating its range, and FilePacket::fromSerialBuffer reaches a default FW_ASSERT when a network file packet contains an unknown file-packet type byte.

F´ (F Prime) before version 4.2.0 has a vulnerability in Svc::FileUplink handleDataPacket offset and size validation. The component checks byteOffset plus dataSize with wrapping U32 arithmetic and then seeks to the large attacker-controlled offset before writing.

F´ (F Prime) before version 4.2.0 has a vulnerability in Svc::GenericHub fromBufferDriver_handler deserialization. The receive handler uses FW_ASSERT for externally influenced deserialization status and type validation and permits a command payload size subtraction to underflow.

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

A flaw in DPDK lib/vhost vhost-crypto causes the indirect-descriptor snapshot to double-fetch a guest descriptor next index. A malicious guest can exploit this to cause an out-of-bounds access in the host backend.

A flaw in DPDK lib/vhost: the VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to a use-after-unmap condition.

The FV Flowplayer Video Player plugin for WordPress, in all versions up to and including 7.5.54.7212, is vulnerable to limited arbitrary file upload via the check_mimetype function. Incomplete file type validation allows an authenticated attacker with subscriber-level access or above to upload potentially executable files, enabling remote code execution. Exploitation requires the plugin's 'profile videos on bio' option to be enabled.

ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (CWE-639). Any authenticated user can iterate the ID parameter to retrieve the full profile record of every other user, including passwords stored in cleartext (CWE-256), enabling account takeover and credential-stuffing attacks.

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php returned the FOG_AD_DEFAULT_PASSWORD value in its domainpass JSON field and could be dispatched through node=ipxe without an authenticated session. The response was also consumed by host and group Active Directory configuration interfaces. This could disclose the default domain-join credential to a remote unauthenticated requester. This vulnerability is fixed in 1.5.10.1870.

Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/query_runner/query_results.py accepts param_query_N_{key=value} parameters and passed attacker-controlled values to replace_query_parameters() for raw substitution into a referenced query's SQL. This path bypassed the ParameterizedQuery schema validation used by normal query execution and omitted the is_safe permission check. An authenticated user with at least view-only access to both the Query Results data source and the referenced data source could therefore inject SQL through text parameters and execute it with the referenced data source's privileges. This issue is fixed in version 26.9.0.

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP request bodies without enforcing a maximum size. An unauthenticated remote client able to reach an affected endpoint can send a large declared or streamed request body that consumes multiple times the body size in process memory and can repeatedly exhaust memory or terminate the server. Stdio-only servers and deployments with an effective upstream request-size limit are not affected, and applications that use StreamableHTTPServerTransport directly remain responsible for enforcing their own limit. The standard SDK server applications and session managers are fixed in versions 1.29.1 and 2.1.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP (wp-payment-form) allows Stored XSS. This issue affects Best Payments Plugin for WP: from n/a through 4.6.27.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooCommerce (hippoo) allows Reflected XSS. This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.12.0.

Missing Authorization vulnerability in Skydropx (skydropx) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Skydropx: from n/a through 2.1.4.

The Model Context Protocol Java SDK, from version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in mcp-core, and from mcp-core 2.0.0-M1 through 2.0.0, reads HTTP request bodies into memory without enforcing a maximum size in Servlet-based SSE, Streamable HTTP, and Stateless server transports. An unauthenticated remote client can stream an arbitrarily large POST body, including chunked transfer encoding, until the Java process exhausts its heap and becomes unavailable.

Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.

An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters list lookup loop forever. Because PgBouncer serves all clients from a single process, this saturates a CPU core and makes PgBouncer unresponsive to all clients until the process is restarted.

In Eclipse ThreadX NetX Duo up to and including 6.5.2.202603, the NetX Secure X.509 parser accepts a certificate whose signature is an empty BIT STRING and records a signature length of 0xFFFFFFFF. A remote peer can present such a certificate during the TLS handshake, before authentication, and make the device read far outside the certificate buffer during signature verification, which is expected to fault.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS. This issue affects SimplyRETS Real Estate IDX: from n/a through 3.2.9.