CVE Vulnerability Catalog

Jodit Editor versions prior to 4.12.26 are vulnerable to Prototype Pollution via the Jodit.modules.Helpers.set() function. An attacker can pass a crafted key chain containing __proto__, constructor, or prototype, leading to Object.prototype modification and injection of unexpected properties.

A stored XSS vulnerability exists in the Tina CMS rich-text component. The URL field in Slate link/image nodes is not sanitized, allowing injection of javascript: or data:text/html URLs. An attacker with content editing privileges can achieve stored XSS that executes when content is viewed by editors or site visitors.

A vulnerability in the Tina headless CMS allows stored XSS and session takeover via unverified postMessage handlers and insufficient URL sanitization in rich-text content. An attacker can forge messages to hijack an authenticated editing session.

The mchange-commons-java library prior to version 0.6.0 has a vulnerability in its JNDI ObjectFactory implementation (JavaBeanObjectFactory) that allows constructing objects of arbitrary classes and initializing their JavaBean-style properties. For certain classes like Swing JEditorPane, this enables HTTP requests to arbitrary URLs, which can be exploited for JNDI injection and deserialization attacks.

Wasmtime prior to versions 24.0.10, 36.0.11, 44.0.3, and 45.0.2 contains a vulnerability in the native WASIp1 implementation where the fd_renumber function fails to properly close the target file descriptor. This causes resource leaks in the host system, potentially leading to exhaustion of file descriptors and resources.

In Jodit Editor prior to version 4.12.18, the Jodit.configure() function and internal ConfigMerge/ConfigProto helpers merged user-supplied options without filtering prototype-mutating keys, leading to a Prototype Pollution vulnerability.

In Silverstripe Framework prior to version 6.2.2, the 'Insert media from web' functionality in the CMS is vulnerable to XSS from a specially crafted embed. This issue was fixed in version 6.2.2.

A Remote Code Execution vulnerability exists in @tinacms/cli prior to version 2.4.3 during the Forestry-to-Tina migration. The addVariablesToCode helper unsafely processes user-supplied label and name fields from .forestry/**/*.yml, allowing arbitrary JavaScript injection into the generated tina/templates.{ts,js} file.

A Use-After-Free vulnerability in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code remotely over a network.

An incorrect authorization vulnerability in GitHub Enterprise Server allowed a user-to-server token scoped to a GitHub App installation to perform write operations on public repositories outside its intended scope. An attacker with a stolen token could create issues, comments, and private vulnerability reports, impersonating the victim without app involvement.

A vulnerability in NodeBB allows a remote attacker to impersonate any local user, including the administrator, by forging posts and private messages via the ActivityPub protocol. The issue stems from missing validation that the authenticated remote actor is the actual author of the ActivityPub object.

Ladybird contains a dangling-reference memory-safety flaw in its WebAssembly ESM-integration module loader. A JavaScript function imported into a WASM module via ESM causes a stack-local FunctionType to be destroyed after the link-loop iteration ends, while the host callback still references it, leading to memory corruption.

The Shenzhen Aitemi M300 Wi-Fi Repeater (model MT02) has an unauthenticated OS command injection vulnerability. Network-adjacent attackers can execute arbitrary shell commands by injecting unsanitized input through the smacfilter_conf handler in the commuos web backend.

The AsyncHttpClient (AHC) library versions 2.0.0 through 2.15.0 and 3.0.0.Beta1 through 3.0.10 have a vulnerability in ThreadSafeCookieStore that does not verify whether the responding host is allowed to set a cookie for a domain. This allows an attacker-controlled host to inject a cookie for an unrelated domain, which the client then sends to that domain.

Pion DTLS library versions prior to 3.1.4 are vulnerable to remote denial of service via a panic triggered while parsing a crafted ECDHE_PSK ServerKeyExchange message. The issue is fixed in version 3.1.4.

Vulnerability in API Platform Core before versions 4.1.30, 4.2.26 and 4.3.12 allows an attacker to substitute resource types in IRI relations. Missing type validation in AbstractItemNormalizer enables assigning an object of an unintended type to a relation property.

In API Platform Core versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a missing isCacheKeySafe gate in the JSON:API and HAL item normalizers causes a cross-user attribute leak. The component cache (attributes, relationships, links) keyed on context cache key can be reused for a subsequent request from a different user with different permissions, exposing properties that should be hidden.

An SQL injection vulnerability in the Cargo extension for MediaWiki allows an attacker to inject malicious SQL code. The issue affects versions before 1.43.9, 1.44.6, and 1.45.4.

A deserialization vulnerability in the RemoteQueryCachePlugin of AWS Advanced JDBC Wrapper versions 3.3.0 through 4.0.0 allows arbitrary code execution via untrusted data from Redis or Valkey cache. An attacker with write access to the shared cache infrastructure can inject a crafted Java object that, when read by the application server, triggers code execution.

A vulnerability in the WikiLambda extension for MediaWiki allows authentication bypass due to improper neutralization of input terminators. Affects versions before 1.43.9, 1.44.6, and 1.45.4.