CVE Vulnerability Catalog

Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guest_user_id and guest_access_token to force an attacker-controlled guest session and destroy unbacked end-to-end encryption keys.

SQLite before 3.54.0 built with the session extension contains a heap buffer overflow in sqlite3changeset_apply(). An attacker can corrupt heap memory by supplying crafted changesets where repeating a table name in a second changeset block with a larger column count causes sessionUpdateFind() to memset past the undersized aUpdateMask allocation.

SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension. An attacker can make applications use freed heap memory by manipulating the %_node shadow table, leading to a process crash.

SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows bypassing the SQLITE_LIMIT_EXPR_DEPTH limit via chained COLLATE operators. An attacker can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view, triggering unbounded recursion and a process crash.

SQLite before 3.54.0 contains an information disclosure vulnerability that allows reading uninitialized page-cache memory by supplying a WAL file with an undersized page size. An attacker can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers.

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete(). An attacker can write past the leaf page buffer via crafted footer key offsets by supplying a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application.

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. An attacker who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.

SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. An attacker can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process.

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows bypassing the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. An attacker can supply a WITH clause chaining tens of thousands of CTEs, causing unbounded selectExpander() recursion and a process crash.

ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerability in mod_copy that allows authenticated FTP users to bypass Limit WRITE restrictions via symlinks. An attacker can place a symlink in a writable directory and use SITE COPY or SITE CPTO to overwrite files in write-denied locations.

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are forbidden.

ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers. An attacker can send FTP command arguments longer than 1024 bytes, without authentication if pre-login commands are rewritten, to corrupt session memory and crash the session.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an OS Command Injection vulnerability due to improper neutralization of special elements used in OS commands. A low privileged attacker with remote access could exploit it to execute commands.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Argument Injection vulnerability due to improper neutralization of argument delimiters in commands. A high privileged attacker with remote access could exploit it to elevate privileges.

Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user.

Use of a weak password encoding algorithm in Płatnik software allows a user who obtains an encoded password to easily decode it.

Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own.

A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module. It may lead to application crashes when processing CBOR data.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an OS Command Injection vulnerability due to improper neutralization of special elements used in OS commands. A high privileged attacker with remote access could exploit it to execute commands.