CVE Vulnerability Catalog

An inefficient algorithmic complexity vulnerability in Bandit's HTTP/2 implementation allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The server walks the entire queue of blocked sends for each frame, resulting in O(n²) list operations for n blocked streams.

An allocation of resources without limits or throttling vulnerability in Bandit's HTTP/2 implementation allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker blocks the stream process and floods it with small DATA frames, which are queued until the BEAM node runs out of memory.

An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, 4.4.0 through 4.4.9, 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, 4.4 all versions, and 4.2 all versions may allow an attacker to execute unauthorized code or commands via crafted HTTP requests.

Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information.

NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint. This may allow an attacker to access files outside the intended directory.

A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed stream, planting a null pointer, and then send PUSH_PROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the application.

Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation. This issue affects Liman MYS from 2.3.4-1124 before 2.3.5-1131.

A flaw was found in HaschekSolutions PictShare up to 3.7.1 in the architect function of src/inc/core.php within the File Upload component. The manipulation causes a race condition, and the attack can be initiated remotely. Attack complexity is rated high and exploitability difficult; the exploit has been published and may be used.

A vulnerability was detected in libimobiledevice up to 1.4.0 in the webinspector_receive_with_timeout function of src/webinspector.c within the Web Inspector component. The manipulation results in a heap-based buffer overflow, and the attack can be launched remotely. The exploit is public and may be used; the vendor did not respond.

A security vulnerability has been detected in libimobiledevice up to version 1.4.0. It affects the afc_file_open function in src/afc.c within the AFC File Handler component. Manipulation of the bytes argument leads to an out-of-bounds read, and the attack can be initiated remotely.

A weakness has been identified in libimobiledevice up to 1.4.0 affecting the service_receive function of src/afc.c in the AFC Service component. Manipulation can lead to a double free, the attack may be performed remotely, and the exploit is publicly available.

Frappe Builder before 1.36.1 contains an SSRF vulnerability in builder/api.py where assert_not_private_url() validates only the initial hostname before requests.get(url) follows redirects with no IP pinning. An authenticated attacker can call the convert_to_webp endpoint (lacking a permission decorator) with a URL redirecting to internal targets such as cloud metadata services, enabling SSRF, internal port scanning, or request-hang DoS due to the missing timeout.

Frappe Builder versions 1.33.0 before 1.36.0 contain a missing authorization vulnerability in the improve_prompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without permission checks. Attackers can call the improve_prompt API to leverage the site owner's stored OpenRouter API key via resolve_api_key, consuming paid LLM credits and turning the site into a free LLM proxy.

Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write access control and performs an unprotected requests.get call that follows redirects without re-validating resolved IP addresses. A low-privilege authenticated user can supply an image_url pointing to an internal address or use DNS rebinding and open redirects to make the server fetch internal resources or cloud metadata endpoints, with successful image responses saved to a world-readable /files/ URL.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Logsign SIEM affects versions from 6.4.120 before 6.4.122. It may allow access to files outside the intended directory.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. There is no verified vulnerability description available for this identifier.

The Mendix SAML module (Mendix 9, 10, and 11 compatible versions before V3.6.29 and V4.2.4 respectively) does not properly protect against SAML assertion replay in IdP-initiated authentication flows. This could allow unauthenticated remote attackers to gain unauthorized access by replaying a valid SAML response.

MISP Guard, a proxy-based security filter for MISP feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_blocked_attribute_categories, and check_blocked_analyst_data_sharing_groups_uuids performed case-sensitive string comparisons when matching event tags, attribute categories, and sharing-group UUIDs against configured allow/block lists.

In libimobiledevice up to 1.4.0, the function afc_get_device_info_key in src/afc.c (Device Info Handler component) has a flaw where manipulation of the Value argument results in memory corruption. The attack requires local access, and a public exploit has been released. The vendor did not respond to the disclosure.

In libimobiledevice up to 1.4.0, an unknown part of src/afc.c (AFC component) contains a heap-based buffer overflow. The attack can be executed remotely, and a public exploit is available. The vendor did not respond to the disclosure.