CVE Vulnerability Catalog

Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution.

A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file /router/filter_arp_put_file.cgi. The manipulation of the argument put_file leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and did not respond in any way.

A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception Matcher. This manipulation of the argument PathPrefix causes improper authorization. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 3.3.5-rc1 will fix this issue. Patch name: 37cd0f27b17cd15cfa4af409bfec943146f5fdfe. Upgrading the affected component is advised.

Thelia 3.0.0's back-office Email/Messages feature contains a server-side template injection (SSTI) flaw allowing any authenticated user with 'Messages' permission to supply unsandboxed Twig templates, executed as raw code. Can lead to full compromise of application and host.

A vulnerability in the hex package manager allows the package owner or an attacker who has taken over the owner's account to publish a new release bypassing the release-age cooldown. The cooldown mechanism that blocks too-fresh versions can be bypassed by retiring the currently locked version, causing the next update to select the new version regardless of its age. Affects hex from 2.5.0 before 2.5.2.

A vulnerability in rebar3 allows a malicious package publisher to delete a directory outside the project's _build directory and extract package files into it when dependencies are fetched. The app field in Hex dependencies is used without validation as a directory name, enabling paths like ../../../../target. Affects rebar3 from 3.7.0-rc1 before 3.27.2.

JAXB factory methods rely solely on FEATURE_SECURE_PROCESSING to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker can read local files via out-of-band XXE.

A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker running a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress, leading to use of freed memory and potentially crashing the GNOME session or arbitrary code execution in the compositor.

Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The item_name parameter does not sanitize directory traversal sequences, allowing an authenticated user with UPDATE-level permissions to write files outside the expected templates directory, including web-accessible paths. Additionally, the translation-writing logic does not escape backslashes, allowing inputs to break out of PHP string literals and inject executable code. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with web-server privileges.

In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation relying solely on client-supplied MIME types. An administrator can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the server.

In Thelia v2.6.0, the document update endpoint does not perform the same validation as the upload endpoint, which blocks executable file types. An attacker with administrative Thelia permissions can exploit this to upload arbitrary executable files, such as malicious PHP scripts, achieving remote code execution.

OS command injection vulnerability in UYAP Document Editor before version 5.4.20 on Windows and Linux and before 5.4.21 on iOS. Improper neutralization of special elements allows execution of arbitrary system commands.

Deserialization of untrusted data vulnerability in UYAP Document Editor on Windows, Linux, and MacOS before versions 5.4.20/5.4.21 allows Object Injection.

SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection by setting Image.MAX_IMAGE_PIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions, exhausting worker memory during decoding.

SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, max_frames, max_tokens_per_frame and max_image_tokens in the video_url object. Attackers can set these values arbitrarily high so glm4v.py decodes every frame of high-resolution video at full size, exhausting worker memory and denying service.

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution before applying max_pixels limits. Remote attackers can submit high-resolution videos to /v1/chat/completions on Qwen-VL deployments, and concurrent requests exhaust worker memory causing denial of service.

SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audio_url or audio_data inputs that expand into massive PCM buffers, exhausting worker memory and CPU for denial of service.

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to /v1/audio/transcriptions. Attackers can send concurrent large multipart uploads, which are fully read into memory before validation, to crash the HTTP/tokenizer worker and deny service.

LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file parts to /upload, persisting files in uncleaned temporary directories and exhausting server disk space.