CVE Vulnerability Catalog

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent-Token can request /api/debug/pprof/* through a route protected by WithAdminRequired because EnvironmentPermissionSet is installed and the request continues without checking IsGlobalAdmin.

A flaw was found in GIMP where an attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when calculating image dimensions during file decompression, the application allocates an undersized memory buffer.

Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Windows allows a local non-administrative user to elevate privileges to NT AUTHORITY\SYSTEM by modifying the EAAntiCheatService service configuration and executable path. This vulnerability requires non-standard manual execution of the standalone installer and does not affect standard game installations via the EA App and Steam.

Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user can request records associated with another employee.

Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values.

ERPNext prior to versions 15.118.0 and 16.27.0 fails to enforce proper authorization checks in certain endpoints of the Sales Person-wise Transaction Summary report. A role-limited authenticated user can read financial transaction rows without applying the requesting user's document permission match conditions, accessing financial data beyond their permitted role.

Tandoor Recipes prior to version 2.6.10 executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or an execution timeout. When an authenticated user stores a catastrophic-backtracking regex and any user in the same Space imports a matching recipe, the automation engine can occupy a Gunicorn worker until its request timeout, exhausting worker slots and making the service unavailable.

A flaw was found in libtirpc involving unbounded decoding of PMAPPROC_DUMP replies. A remote attacker can send specially crafted replies to a client application using the pmap_getmaps() function against an attacker-controlled host, causing excessive memory and CPU allocation and a denial of service (DoS) in the client process due to resource exhaustion.

A flaw was found in libtirpc allowing an authenticated remote attacker to send oversized wrapped data requests to an RPC service configured with RPCSEC_GSS integrity or privacy. This leads to unbounded memory allocation and a denial of service (DoS) by exhausting system resources, causing the service to become unstable or terminate.

IBM i versions 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper enforcement of the ChrootDirectory configuration directive.

IBM i versions 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.

IBM i versions 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution.

IBM i versions 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag.

Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to limit the file types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.

IBM i versions 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager (DCM) for System TLS using applications attempting to create secure network connections. A bad actor could use this to prevent a service from starting or cause it to fall back to non-secure connections.

GPAC MP4Box v2.4 contains a floating point exception in the gf_parse_lfrac function (utils/error.c). Processing a crafted MP4 file containing a zero-denominator fraction string causes gf_parse_lfrac() to divide by zero, terminating the process with SIGFPE.

A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted.

Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network.

Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu permission can enumerate sequential IDs on freezeContainerStock and unfreezeContainerStock endpoints to freeze or unfreeze container stock in other warehouses.