CVE Vulnerability Catalog

An Out-of-bounds Write vulnerability in the SSR TCP proxy/optimization path in Juniper Networks Session Smart Router allows an attacker to corrupt forwarded packet data. This can potentially cause a data-plane crash via a transit TCP packet with a crafted TCP option length.

An Out-of-Bounds Read vulnerability in the HttpParser component in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to cause a denial of service. Exploitation occurs via a specially crafted HTTP request.

A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications (incorrect authorization).

A heap buffer overflow caused by mismatched size usage in the CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14. Authenticated X clients could use it to crash the server or potentially execute code in the X server context.

A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14. Authenticated X clients could use it to crash the server or execute code within the X server context.

The Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint, bypassing CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file.

In YosemiteCrew, service and PMS task-library/template routes omit organization and permission checks. Any authenticated platform user, including a patient account, can modify or delete another organization's service catalogue and PMS template data, and service records can be read without authentication.

Shopper is a headless e-commerce admin panel. From 2.8.0 until 2.8.1, three Livewire admin components retain authorization gaps: a staff member with only `view_users` and `access_dashboard` can mutate permissions, create an administrator, or delete roles. They can grant arbitrary permissions including `access_setting` to their own role, create a pre-verified administrator with a chosen password, or delete roles, enabling privilege escalation and RBAC denial of service.

Xibo before 4.4.3 lacks authorization on POST /displaygroup/criteria/{displayGroupId}, allowing an authenticated user to send criteria updates to any display via XMR. These criteria affect scheduling and can alter playback. The issue is fixed in version 4.4.3.

Xibo before 4.4.3 lacks access-control checks on GET /layout/status/{id}, allowing an authenticated user with any privileges to view the status and metadata of any layout, including those they do not have view rights to. The issue is fixed in version 4.4.3.

Xibo before 4.4.3 lacks object-level authorization on /notification/export/{id}, allowing an authenticated user to download attachments from any notification, including those created by administrators, by iterating over sequential notification IDs. Exploitation requires access to the Notification Centre, a privilege granted to non-administrators as standard. The issue is fixed in version 4.4.3.

SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In builds after release-820-01 and before the May 7, 2026 nightly, the `bcp_api.cpp` loop over the JSON `sockets` array uses `slot_data["sockets"].Size()` without bounding `gem_idx` by `MAX_GEM_SLOTS` (four), writing beyond `gem_id` into adjacent `gem_bonus_id` storage. Corrupting a vector's `_M_start` pointer causes the `item_t` destructor to free an attacker-influenced pointer. The advisory reports crashes and code execution demonstrated in a testing environment.

The `excerpt-include` macro in XWiki Remote Macros does not properly escape the included page's title and executes `excerpt` content with the macro's rights. Both the title handling and the rendering of `excerpt` content into XWiki syntax allow syntax injection. Any user able to edit a page, even without script rights, can supply executable macro syntax and cause remote code execution when the page is included.

The Athena module in AWS SDK for pandas (awswrangler) before 3.16.1 did not verify ownership of the default query result location, potentially allowing remote actors to read Athena query results and tamper with result sets returned to the caller via a pre-created S3 bucket. The issue is fixed in version 3.16.1.

FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 holding both the user's API token and the global FOG API token can use PUT /fog/storagenode/{id}/edit to modify Storage Node user, pass, and ftppath fields because the API does not enforce an administrator-only role. With storage replication enabled, FOGImageReplicator interpolates those fields into an lftp command executed through proc_open() by the root-running service, allowing command execution as root.

USB Test is a lightweight Windows CLI utility for verifying sector integrity and detecting overreported capacity on USB flash drives. Prior to version 1.1.5, getSectorSize() in `USB Test/src/driveinfo.cpp` trusts DISK_GEOMETRY.BytesPerSector returned by IOCTL_DISK_GET_DRIVE_GEOMETRY without checking success or enforcing size bounds. The value is used for division and to size a heap buffer before memcpy, so a malicious USB storage device can report a value below eight bytes causing repeated out-of-bounds writes, or zero causing a divide-by-zero denial of service.

GFI KerioConnect Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vulnerability caused by weak installer permissions that leave the product directory writable by the built-in Users group. A local non-administrative attacker can replace the searchd.exe service binary used by the bundled KOFFIndexingService, which runs as LocalSystem, to execute arbitrary code with NT AUTHORITY\SYSTEM privileges upon the next service start or reboot.

GFI KerioConnect before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose text is already inside a link. Attackers exploit the link auto-formatter's re-processing of already-linked text, using quote characters to break out of the href attribute and inject attacker-controlled markup to execute script in the victim's session.

A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange exists in X.org X server before 2.1.25 and XWayland before 24.1.14. Authenticated X clients could exploit it to crash or potentially execute code in the X server context.

A buffer overflow when handling pointer barriers in the XFIXES extension exists in X.Org X server before 21.1.25 and XWayland before 24.1.14. Authenticated X clients could exploit it to crash or potentially execute code in the X server context.