CVE Vulnerability Catalog

CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header. The cookieConf() function rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter; the same cookie sent in the X-Session-Cookie header is accepted regardless of age.

CallBackery versions before 0.62.0 for Perl allow session cookie forgery due to a signing secret generated with rand(). The secret is built from two calls to the built-in rand(), seeded with 32 bits, so it has at most 2^32 possible values, and one signed cookie is enough to test each candidate offline.

Bitcoin Core prior to 29.5, 30.4, 31.2, and 32.1 is vulnerable to an OOM (out-of-memory) issue. The description does not provide further technical details.

Skuul School Management System through version 2.6.5 is vulnerable to incorrect access control in the ResultChecker::checkResult method. An authenticated student can manipulate the studentId parameter to retrieve another student's examination results, including marks, without authorization.

A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page. The 'tlsErrorPage' script message handler is registered immediately before loading the error page, leaving a brief window where the previously loaded untrusted origin can call postMessage and approve a certificate exception without user interaction.

The Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability. Unauthenticated attackers can submit frontend forms without valid verification by omitting the g-recaptcha-token field in POST requests, because the verify() method returns early on empty token values.

The Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API. A user with Kirki edit access (granted to the Editor role by default) can modify the title, slug, and publication status of any non-trashed post of any post type, including custom post types and WooCommerce products they do not own.

Dell OpenManage Enterprise versions prior to 4.8.0 contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to server-side request forgery.

Dell OpenManage Enterprise versions prior to 4.8.0 contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low-privileged attacker with local access could potentially exploit this vulnerability, leading to protection mechanism bypass.

OpenManage Enterprise versions prior to 4.8.0 contain an Improper Resource Locking vulnerability. A high-privileged attacker with local access could potentially exploit this vulnerability, leading to protection mechanism bypass.

Campfire is a web-based chat application. In version 1.4.4 and earlier, when a Campfire message contains a link, the server fetches it to build an OpenGraph unfurl preview. RestrictedHTTP::PrivateNetworkGuard relied on Ruby's IPAddr#private?, IPAddr#loopback?, and IPAddr#link_local? predicates plus IPv4-mapped and IPv4-compatible checks, which do not cover several special-use ranges. An authenticated user can post a link to a hostname resolving to CGNAT 100.64.0.0/10, NAT64 64:ff9b::/96 or 64:ff9b:1::/48, or 6to4 2002::/16 to bypass the guard and cause server-side requests to internal network resources. The NAT64 and 6to4 ranges can embed an internal IPv4 target. Confidentiality impact is limited to returned OpenGraph metadata, and most internal endpoints return none. There is no integrity or availability impact. An initial fix was released in version 1.4.5.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Input Validation vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution.

DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds. The _normalize_leap_seconds function crosses day boundaries one day at a time, so add(seconds => $n) on an object with a non-floating time zone takes about |$n|/86400 iterations, and nothing limits $n; both the XS implementation and the pure-Perl fallback have the loop.

An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with standard user permissions access a device interface belonging to a privileged kernel driver and send specially crafted requests.

In the mDNS component for ESP-IDF before version 1.11.2, mdns_utils_read_fqdn() follows DNS name-compression pointers recursively without capping depth. An unauthenticated attacker on the same link-local network can send a crafted packet to UDP port 5353 and exhaust the mDNS FreeRTOS task stack, causing a controlled panic and reboot.

CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are hashed with hmac_sha1_sum() from Mojo::Util with no key, no salt and no work factor, so equal passwords give equal hashes and guessing is fast.

Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate. confirm_resource takes no session token from the caller and always accepts the flow, and since version 1.00 a flow with a mandate is returned as confirmed without being completed again.

Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signature_valid uses each configured secret as the HMAC key, and Digest::SHA treats undef and an empty string as an empty key.

Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature. A payload with a top-level "payload" key is flattened into key-value pairs, where a long key holding a long array costs memory proportional to the key length times the array length.

CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig. getUserConfig() returns the caller's whole cbuser row, and getTableData() and getAllFieldValues() also return the note to users without the admin right.