CVE Vulnerability Catalog

IBM Guardium Data Protection 12.0, 12.1, and 12.2 are vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7 protocol parser. A remote attacker could send a specially crafted TDS LOGIN7 packet with invalid offset or length values, potentially causing information disclosure or denial of service.

Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in its optimization module that allows local unprivileged users to delete arbitrary folders as SYSTEM. Attackers can replace a scanned duplicate file's directory with a junction to C:\Config.msi and abuse Windows Installer rollback to execute code as SYSTEM.

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper component. An authenticated high-privileged user can inject arbitrary commands through attacker-controlled arguments, resulting in command execution with root privileges.

IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerability in the edge-controller. An unauthenticated remote attacker with network access to the edge-controller gRPC service can provide malformed task data that triggers an unchecked type assertion, causing the edge-controller process to terminate unexpectedly.

Reflected Cross-site Scripting (XSS) vulnerability in the aBlocks plugin by Kodezen LLC. Improper input neutralization during web page generation allows an attacker to inject malicious scripts.

Prototype pollution vulnerability in the dot-access library up to version 1.0.0. An attacker controlling the path (e.g., via user-supplied field names) can use __proto__ segments to inject properties into all objects.

Vulnerability in MariaDB Connector/Node.js before versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4. When using the text protocol, escaping always prefixes quotes with a backslash and does not honor the NO_BACKSLASH_ESCAPES mode, allowing SQL injection via an attacker-controlled value.

Vulnerability in MariaDB Connector/Node.js from 3.2.0 to 3.2.5, 3.3.4, 3.4.7, and 3.5.4. When permitSetMultiParamEntries is enabled, object keys are expanded into a SQL SET clause without being processed by escapeId, allowing SQL injection via a key containing a backtick.

Vulnerability in MariaDB Connector/Node.js before versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4. The GeoJSON Polygon and MultiPolygon binary encoders allocate memory via Buffer.allocUnsafe() based on each ring's numeric length before confirming the ring is an array, potentially disclosing uninitialized Node.js heap data.

An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper via a crafted database command value introduced in the agent context.

Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document, can cause invalid memory access and invalid frees in the client process.

In OpenStack Mistral through 23.0.0, several v2 API write paths resolve the target object with a query that can return another project's resource, then write to it. An authenticated project member can use this to rewrite and un-publish another project's public action definitions and environments.

In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state.

In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyCommand() before any SSH connection is attempted. An authenticated project member can use the standard action-execution API to submit an arbitrary local command as proxy_command, which is started as a subprocess on the executor host. Only deployments that permit the std.ssh_proxied action, the default configuration, are affected.

CairoSVG prior to 2.9.1 has a performance issue when rendering an SVG with a path containing many segments, causing quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while draw_markers drains node.vertices with pop(0), causing repeated linear-time work. The svg2png, svg2pdf, and svg2ps APIs reach these operations during ordinary rendering, allowing a sub-megabyte SVG to consume substantial CPU and deny service.

datamodel-code-generator from 0.59.0 until 0.81.0 has a vulnerability where an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAK_IMPORT_PATTERN and consumed by _write_missing_weak_imports. Exploitation requires a victim or automated job to process the schema with Protobuf input support (grpcio-tools). The paths escape the weak_imports temporary directory, allowing creation of directory trees, new files, or overwrite of existing writable files with a generated Protobuf syntax declaration.

webonyx graphql-php prior to 15.32.3 has a stack exhaustion vulnerability in GraphQL\Language\Parser, which performs recursive descent without a recursion limit in parseSelectionSet, parseValueLiteral, and parseTypeReference. A remote attacker can submit deeply nested selection sets, object or list values, or list types that exhaust the PHP process stack during pre-validation parsing. The resulting SIGSEGV can terminate PHP-FPM workers or long-running processes.

JHipster from 7.0.0 until 9.4.0 has a vulnerability in generated reactive applications (Spring WebFlux, Spring Data R2DBC, SQL). The attacker-controlled sort request parameter is passed into createOrderByFields in EntityManager_reactive.java.ejs, and rendered into the SQL ORDER BY clause without validation or quoting. The R2DBC simple query protocol can execute additional statements separated by semicolons. A normal authenticated user can read sensitive tables, modify or delete data, or drop tables.

The bundled FilePond PHP server in Malcolm's file-upload component exposes a fetch route that retrieves an arbitrary URL and returns the response to the caller. An authenticated user can exploit this server-side request forgery (SSRF) to read HTTP, HTTPS, or FTP resources reachable from the upload container.

The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS. An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wipe which permanently deletes all captured network traffic and forensic logs, or control.py --stop which blinds the security monitoring.