CVE Vulnerability Catalog

Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass allowing users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can send blind requests to internal services and cloud metadata endpoints.

libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpecialTable without an upper bound check. Attackers can supply crafted captions designating the Latin special set with ESC 28 4C followed by bytes 0x6F-0x7E to leak adjacent read-only data or crash decoding.

libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a zero byte to applications using the buffer constructor, causing strlen to overrun the heap buffer and possibly crash.

NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers to read local image files via unvalidated synced sourceUrl paths. Attackers with write access to the victim's sync target can plant absolute paths or file:// URLs, causing image_inspect to send local images to the AI provider.

A vulnerability was detected in TufayelLUS TikTok-Video-Downloader-PHP up to commit c4230497bb23dd9c1f81456fe8a982d951feac0d in unknown functionality of index.php within the TLS handler component. Manipulation leads to improper certificate validation, and the attack can be launched remotely, though it requires high complexity and is difficult to exploit. A patch is available in commit 64c0155abb88e714198241d41b918cefc0d5a42a.

A vulnerability was found in GlitterWare Passy up to 1.10.1 in the MyHttpOverrides function of lib/main.dart within the TLS handler component. Manipulation leads to improper certificate validation, and the attack may be launched remotely, though it is characterized by high complexity and difficult exploitability. Upgrading to version 1.10.2 fixes the issue (patch 3d48df7cce05e39fa4de1e42768492307f26882e).

A vulnerability was found in f3-factory fatfree-core up to 3.9.2 in the _curl function of web.php within the HTTP client component. Manipulation leads to improper certificate validation, and the attack may be performed remotely, though it is highly complex and difficult to exploit. Upgrading to version 3.9.3 resolves the issue (patch a2c755c8dc9ad0eb7d5fd261b09aff90f649433c).

A vulnerability was found in SourceCodester Inventory System 1.0 in unknown processing of /api/transactions_handler.php?action=save_sale within the sales management handler component. Manipulating the Hsn_Code argument results in cross-site scripting (XSS), and the attack can be launched remotely.

A vulnerability was found in SourceCodester Inventory System 1.0 in the file /api/transactions_handler.php (action save_purchase) of the Purchase Records Handler. Manipulation of the Product_Name, Product_Code or Vendor_Name arguments leads to cross-site scripting. The attack can be performed remotely and the exploit has been publicly disclosed.

A flaw was found in SourceCodester Inventory System 1.0 in the file /api/products_handler.php (action save) of the Product Management component. Manipulation of the Product_Id or Product_Name arguments can lead to cross-site scripting. The attack can be performed remotely and the exploit has been published.

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers. This allows users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.

The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total. This allows an unauthenticated visitor who knows a valid discount code to create a confirmed booking stored with a negative total.

In diem-project diem up to commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad, the dmBaseLinkTag::text function in dmCorePlugin/lib/view/html/link/dmBaseLinkTag.php (dmWidget component) is vulnerable to cross-site scripting via manipulation of the text argument. The attack can be performed remotely and the exploit is publicly available; the project has not responded to the report.

In diem-project diem up to commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad, the dmString::random function in dmCorePlugin/lib/basic/dmString.php uses a cryptographically weak PRNG. The attack may be performed remotely but is of high complexity and difficult exploitability; the exploit is publicly available and the project has not responded to the report.

In diem-project diem up to commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad, the append function in dmAdminPlugin/modules/dmConsole/actions/actions.class.php (Administrative Console component) is vulnerable to cross-site scripting via manipulation of the dm_command argument. The attack can be executed remotely and the exploit is publicly available; the project has not responded to the report.

In diem-project diem up to commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad, the html function in dmAdminPlugin/web/js/dmAdminCtrl.js (Version Check Service component) is vulnerable to cross-site scripting. The attack can be performed remotely and the exploit is publicly available; the project has not responded to the report.

A flaw in the Google Analytics Client component of diem-project diem causes improper certificate validation. Data manipulation can lead to acceptance of an invalid certificate, and the attack may be launched remotely. The exploit has been publicly disclosed and may be used.

A cross-site scripting vulnerability was found in Chamilo LMS in the TicketManager::addProject function (file main/inc/lib/TicketManager.php) via manipulation of the Name argument. The attack may be performed remotely and the exploit has been publicly disclosed. A patch is available.

An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD routing daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the authorized range. BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. The rule can pass validation and be propagated to downstream peers.

In diem-project diem, in file lib/model/doctrine/PluginDmUser.class.php (SHA1 Handler component), manipulation of the salt/password argument leads to password hashes with insufficient computational effort. The attack requires local access and high complexity, and the exploit has been publicly disclosed.