CVE Vulnerability Catalog

App passwords were allowed to bypass password confirmation on sensitive endpoints. This enabled sensitive operations to be performed without re-authentication.

A public shared collective always allowed recipients of the link to create pages.

By abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely because there is no automatic cleanup mechanism, leading to three distinct denial-of-service conditions that self-renew on a 24-hour cycle.

A missing token type check allowed retrieving additional information about the WOPI configuration with a user or guest token.

Asterisk prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3 contains a stack buffer overflow in the H.323 ooTrace() trace-logging function. An unbounded vsprintf writes into a fixed 2048-byte buffer, which can crash the Asterisk process when a crafted packet is sent.

In Asterisk, an authenticated attacker may cause a `T.140 RED` heap buffer overflow using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The `chan_sip` channel driver must be installed and configured with its `textsupport` option enabled (defaults to no). Patches are contained in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11 and 22.8-cert3.

Asterisk prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3 contains an unbounded memcpy of OGG/Speex packet data in format_ogg_speex. This can cause a heap buffer overflow and crash Asterisk when reading a file containing corrupted Speex audio.

An out-of-bounds write in the chan_unistim module's DIALPAGE digit handling can overflow the phone_number field and crash Asterisk when a crafted incoming request packet is sent. The chan_unistim module must be loaded and configured with a reachable UNISTIM UDP port, and the attacker must register as a configured phone MAC or use an equivalent autoprovisioning path. The issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

In Asterisk, an authenticated attacker may cause a `T.140 RED` out-of-bounds write during generation accumulation using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The `chan_sip` channel driver must be installed and configured with its `textsupport` option enabled (defaults to no). Patches are contained in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11 and 22.8-cert3.

An authenticated attacker may crash Asterisk through a buffer over-read in the PJSIP MWI body parser by sending a crafted SIP NOTIFY request. The attacker must pass SIP authentication using a username/password or source IP address matching. The issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

In knative.dev/pkg/webhook, the admissionHandler decodes an attacker-supplied AdmissionReview without a request body size limit (no http.MaxBytesReader). A pod-network client can send one oversized POST to an admission webhook, causing amplified copies of the request to be retained until the controller pod exhausts memory and is OOM-killed. This affects all consumers of the shared webhook server, including Knative, Tekton, KEDA, Sigstore policy-controller, and Kpack; fixed in version 0.0.0-20260531000007-52dbd5ece63f.

Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation requires user interaction, as the victim must open a malicious file.

Substance3D - Painter is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a malicious file.

Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, as a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

A vulnerability was identified in oretnom23 php-travel-agency-system affecting admin/customer_detail.php in the Admin Record Pages component. Manipulation of the costomer_id/ticket_id/emp_id/salary_id/page_id arguments leads to SQL injection, and the attack can be initiated remotely.

A SQL injection vulnerability exists in oretnom23 php-travel-agency-system in the file admin/customer_search.php. Manipulating the customer_name, voucher_no, or emp_name arguments allows SQL injection. The attack can be performed remotely and a public exploit is available.

An unrestricted upload vulnerability exists in oretnom23 php-travel-agency-system in admin/employee_insert.php via manipulation of the employee photo argument. An attacker can remotely upload arbitrary files. A public exploit is available.

TinyMCE versions 7.9.3 through 7.9.4 and 8.5.1 through 8.9.3 contain a stored XSS vulnerability in the media plugin. Elements crafted via data-mce-object can execute malicious scripts during processing before sanitization. The issue is fixed in 8.9.3 and 7.9.4.

In the systeminformation library, networkStats(ifaces) in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the _network object indexed by the sanitized caller-controlled interface name. Passing proto causes the inherited Object.prototype value to be used instead of creating an own entry, so calcNetworkSpeed() writes rx_bytes, tx_bytes, rx_sec, tx_sec, ms, last_ms, and operstate onto Object.prototype. The polluted property names are fixed and values come from interface statistics, but name collisions and enumerable keys can corrupt application branching, serialization, configuration merging, validation, or lookup behavior; fixed in version 5.33.13.

In the systeminformation library for Node.js before 5.33.14, the Linux `networkStats(iface)` implementation uses the caller-supplied interface value in an `fs.existsSync()` check and to build `/sys/class/net/<iface>` paths without verifying it is a single interface-name segment or that the resolved path stays under `/sys/class/net`. An attacker controlling `iface` can use parent-directory components and symlink traversal to make the API return the first line of a file readable by the Node.js process. This requires local filesystem setup; the issue is fixed in 5.33.14.