CVE Vulnerability Catalog

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability. Pull request commenters can hijack CI test reports by posting comments with a predictable marker because findComment and upsertComment in post.ts do not check the comment author.

In fast-uri (a Node.js URI parser) before 2.4.8, 3.0.0–3.1.8, and 4.0.0–4.2.2, serialize(), normalize(), or resolve() with the non-default suffix option on a reference without authority can emit a relative reference with an unescaped bare colon in its first path segment. This can cause the string to reparse as an absolute URI with a scheme such as javascript:, data:, or vbscript:.

In fast-uri (a Node.js URI parser) before 2.4.8, 3.0.0–3.1.8, and 4.0.0–4.2.2, normalize() and serialize() apply RFC 3986 dot-segment removal to the path of a relative-path reference, although that algorithm is defined only for the merged target path during resolution. As a result, a leading parent-directory segment can be dropped and a document-relative reference can become root-relative.

A permissions issue in macOS Golden Gate 27 allowed an app to access information about a user's contacts. It was fixed with additional sandbox restrictions.

An out-of-bounds read in Xcode was addressed with improved input validation. Parsing a maliciously crafted binary may lead to unexpected tool termination.

A memory corruption issue in macOS was addressed with improved input validation. The issue affects macOS Golden Gate 27, macOS Sequoia 15.8 and macOS Tahoe 26.7. An attacker in physical proximity may be able to corrupt process memory.

The issue was addressed through improved state management. The issue affects iOS and iPadOS. An attacker with physical access to a locked device may be able to bypass Digital ID authentication when iPhone Mirroring is active.

Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the _Session class when creating sessions. An authenticated user or anyone holding that user's session token can send POST requests to /sessions or /classes/_Session to create additional sessions and add fields to _Session; these sessions are not revoked when the original session is logged out.

markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.

A vulnerability was detected in grandnode grandnode2 up to 2.3.0. It affects the Html.Raw function in the file src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml in the Product Description Handler component. Manipulation leads to cross-site scripting (XSS). The attack can be launched remotely. Upgrading to version 2.4.0-beta or 2.4.0 addresses the issue.

IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not limited to only trusted domains.

IBM Concert versions 1.0 through 3.0.0 is vulnerable to improper certificate validation. The application incorrectly verifies certificates, potentially accepting forged or invalid certificates.

IBM Concert versions 1.0 through 3.0.0 use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected.

IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation.

A vulnerability was detected in Webkul Aureus ERP up to 1.6.0 in UserForm.php involving manipulation of the Password argument, resulting in weak password requirements. The exploit is publicly available and attack complexity is high.

In AIOHTTP prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user accessing an untrusted subdomain may have host-only protections stripped from cookies.

The software accepts user-supplied data without sufficient validation, allowing injection of malicious Expression Language (EL) code. This can lead to execution of arbitrary operations within the affected deployment.

In MemTensor memmy-agent up to 1.0.9/1.1.1/1.2.2, the requireAdminWrite function in Memory/src/server/http.ts causes resource consumption. The exploit is publicly available and attack complexity is high.

In FOSSBilling from 0.8.4 until 0.8.6, hasManagePermission fails open for inactive non-core modules, skipping access checks. A low-privileged staff account can read decrypted extension secrets and overwrite stored configuration of a deactivated module.