CVE Vulnerability Catalog

libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005c_init(). Malicious USB devices can supply an unbounded allocation table entry count to overwrite the saved return address and heap data, potentially achieving code execution.

LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send-email with any recipient, subject, and raw HTML body.

Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can read withdrawn content, while shares.revoke returns 404 and blocks revocation.

GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts by submitting document text to /api/index. Malicious HTML is returned unescaped by searcher/engine.go and rendered with v-html in dashboard.vue, executing script in an administrator's browser.

OwnTone Server through 29.3 contains an SQL injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. A crafted 'sticker find song' command to the MPD listener on TCP port 6600 bypasses path restrictions and enumerates all media files with filesystem paths and metadata.

QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or shrinks the buffer to exhaust heap memory and cause denial of service.

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an out-of-bounds read vulnerability in the tgatoppm converter's get_pixel() function that uses unchecked pixel values as color map indexes. A crafted color-mapped Targa file can crash the converter or leak adjacent memory into the output image.

Camaleon CMS before 2.9.2 contains an insecure direct object reference vulnerability in Admin::CategoriesController that allows authenticated users to modify unauthorized categories by referencing arbitrary category IDs. Users authorized for one post type can send update or destroy requests pairing another category ID with their authorized post_type_id to rename or delete categories.

PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML files with image extensions via /share/v1/common/file/upload. Attackers can lure administrators to /static-file/<key>?a=.pdf, bypassing the nginx attachment header to serve HTML inline and steal the panda_wiki_token JWT for session takeover.

MrDoc through 1.1.1 contains a missing authorization vulnerability in the get_doctemp view that allows authenticated users to read other users' document templates. Attackers can enumerate the sequential doctemp_id POST parameter to retrieve the private template content of every user on the instance.

Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated users to subscribe to other users' private channels by supplying arbitrary channel names. Attackers can request a signature for private-chatify.<victim id> via POST /chat/auth to receive the victim's incoming private messages and attachments in real time.

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders return an overflow error without releasing the Module Manager mutex when a module preamble declares a data or stack size that overflows the allocation arithmetic. Loading such an image blocks every later module load, start, stop and unload from other threads until the system is reset.

Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration. An authenticated non-administrative user can bypass document ownership restrictions by searching for and linking another user's private document ID to their own warranty, enabling unauthorized read access to private documents via the shared Paperless-ngx API credential.

StageIt extension for Joomla (versions 1.0-5.7.5 and 6.0-6.3.5) contains a Reflected XSS vulnerability. Malicious JavaScript can be reflected in the server response and executed in the victim's browser.

The Users Anywhere extension for Joomla (regularlabs.com) before 3.0.1 exposes sensitive information to unauthorized actors. Attributes supplied inside {user}, [email] or [username] tags can override the plugin settings for that render, e.g. [email allow_output_email="1"] displays an email address even when Allow output of email is set to No.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Filesystem access for attacker.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Information exposure.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command execution.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information tampering.