CVE Vulnerability Catalog

A flaw was found in Ghostscript. When processing a specially crafted TrueType font or a document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow.

Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center Collector service.

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.

A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.

WeGIA prior to 3.8.7 has a stored cross-site scripting vulnerability in saude/historico_prontuarios.php because the textoProntuario field accepts arbitrary HTML or JavaScript without proper sanitization. Stored content is rendered and executed in another user's browser when viewing a patient's medical record history.

In SOCFortress CoPilot prior to 0.1.76, case-report templates uploaded by the lowest-privilege customer_user role are later executed by non-sandboxed Jinja2 engines when an admin or analyst generates a report. Lack of template content validation and cross-tenant scoping allows an attacker to inject malicious Jinja expressions that are evaluated as Python on the backend.

WeGIA prior to 3.8.7 has a stored DOM cross-site scripting vulnerability in web/html/memorando/listar_despachos.php resulting from unsafe handling of the texto field. FILTER_SANITIZE_SPECIAL_CHARS is applied during storage, but html_entity_decode() later decodes the content and jQuery .html() inserts the result into the DOM.

In WeGIA before version 3.8.7, the /controle/control.php dispatch endpoint accepts attacker-controlled nomeClasse, metodo, and record identifier parameters via extract($_REQUEST), and the affected Controle CRUD methods do not verify record ownership. Any authenticated user can view, modify, or delete another user's records, exposing CPF, RG, addresses, medical records, financial data, and employee records. Additionally, AtendidoControle and InternoControle lack CSRF validation.

In Lightdash through 0.3213.0, the dbt Cloud webhook POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook has no authentication or signature validation. Unsanitized accountId and runId values are interpolated into the server-side dbt Cloud API URL, which is requested with the victim project's API key in the Authorization header.

Docat has an arbitrary file upload vulnerability in its Upload API because the API does not validate the uploaded file path or type. An attacker can overwrite sensitive configuration files or place malicious files on the Docat web server.

In OpenAM prior to 16.1.1, the Cross-Domain Single Sign-On (CDSSO) servlet allows a logged-in user's raw session token to be POSTed to an attacker-controlled URL. An attacker can induce an authenticated victim to visit a crafted URL and capture the session credential.

On Linux, an authenticated low-privileged Nessus user with scan-creation rights could read arbitrary text files on the scanner host with the privileges of the nessusd process by running a custom Unix compliance audit against the scanner itself.

In GraphQL-core from 3.3.0a3 until 3.3.1, validate() reuses a module-level ValidationAbortedError when a document exceeds max_errors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validation context, and error set for the process lifetime.

Fiber is an Express-inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain.

joserfc is a Python library implementing JOSE standards. Prior to 1.7.6, compact JWS deserialization calls bytes.split() before enforcing existing aggregate segment-size limits. When attacker-controlled compact serialization bytes reach deserialize_compact(), the split creates copies of the header, payload, and signature segments before ExceededSizeError rejects them, causing an additional allocation approximately proportional to the supplied token.

In joserfc prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization recipients array without a count limit and calls decrypt_cek() for every entry. An unauthenticated attacker can control the number of private-key decryption operations performed by one request.

In Nx from 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin options from nx.json into command arguments. The @nx/maven targetNamePrefix value and arbitrary @nx/gradle option names or values can be interpreted as shell syntax.

Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt. When a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the workbook, and the eval runs while Spreadsheet::XLSX->new parses it.