CVE Vulnerability Catalog

VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW intent to the exported StartActivity, making VLC write attacker-chosen content under an attacker-chosen name in the shared Download directory, overwriting other apps' files when VLC holds All files access.

Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner. A malicious active partner can declare an unvalidated BSend total length (up to 65535 bytes) and send a short fragment, causing BRecv to memcpy past the buffer and crash or corrupt SCADA, HMI or gateway processes.

RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes ply_read_list_property() call an out-of-bounds handler, crashing ASCII parsing or corrupting memory in binary parsing.

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the nextRestore() and nextBackup() functions in the backup controller accept a file GET parameter and concatenate it directly to DIR_BACKUP without calling sanitizeFileName(). This allows an authenticated administrator to read arbitrary files on the server (via nextRestore) and write SQL dump content to arbitrary locations (via nextBackup).

The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form.

The WebSocket streaming client in agentjido req_llm starts WebSockex without TLS options, so WebSockex defaults to insecure: true and connects with verify: :verify_none, meaning the server certificate is not validated. The option allowlist also drops any caller-supplied cacerts or ssl_options, so an application cannot enable verification. The OpenAI Responses, Realtime, and Codex WebSocket paths send the API key or OAuth access token in the authorization header, which an on-path attacker can read and modify.

The plug_crypto library in Elixir exposes sensitive information (including the secret key base) in application logs when a wrong-typed argument is passed to public functions. Because type validation happens in function-head guards, a failed guard raises FunctionClauseError with the actual argument values in the top stack frame, and the library's rescue blocks and prune_args_from_stacktrace/1 never catch guard failures. Plug.Cowboy and Bandit write that frame to the error log and attach it as crash_reason Logger metadata, which error trackers forward.

HmacShaCryptor.Hash never hashed its input — for any input it returned HMAC_K(""), the MAC of the empty message under the key. As a result, every AES-CBC-HMAC JWE produced or verified by gose carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely.

JweDirectDecryptorBlock.Decrypt read a 64-bit plaintext length from the _thales_aad protected-header field and used it without any validation. A truncated field panics binary.BigEndian.Uint64, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with a slice-bounds error.

JweRsaKeyEncryptionDecryptorImpl.Decrypt passed the JWE's initialization vector to cipher.AEAD.Open without checking its length. The Go standard library panics rather than returning an error when a GCM nonce is not exactly NonceSize() bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine.

gose parsed the JWS crit header into JwsHeader.Crit and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand; gose implements no header extensions, so every token carrying a non-empty crit should have been rejected — and none were.

LoadPublicKey resolved an EC key's curve with an unchecked type assertion, algToOptsMap[alg].(*ECDSAOptions). A JWK declaring "kty":"EC" together with a non-EC "alg" — which RFC 7517 §4.4 permits — reaches that assertion and panics.

JwtClaims.MarshalJSON built a Go struct at runtime with reflect.StructOf, synthesising a field named "A" + claimName for each untyped claim. reflect.StructOf panics when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT claim names.

jwkFields.CheckConsistency detected duplicate key_ops entries using a pairwise nested loop, making validation cost grow with the square of the entry count. Because the check runs on every JWK and JWKS unmarshal, a modestly sized but hostile JWKS document could occupy a CPU core for many seconds.

JwksTrustStore.Get assigned each parsed key to the function's named return value while refreshing the JWKS cache. When the requested kid was not present, the trailing naked return handed the caller the last key in the JWKS document together with a nil error — a confidently wrong answer instead of "not found".

AesGcmCryptor.Open passed a caller-supplied nonce straight to cipher.AEAD.Open without checking its length. The Go standard library panics rather than returning an error when a GCM nonce is not exactly NonceSize() bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine.

In the BlueSpice container image (bluespice/wiki), the default value of $mwsgTokenAuthenticatorServiceCIDR in LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the WIKI_SERVICE_TOKEN_AUTH_ALLOWED environment variable was not set. An empty value disables the IP restriction in the token authenticator component, allowing any user with read access to the wiki to obtain a token from the REST API and get a session with sysop privileges as the internal service user.

The BlueSpiceUserManager extension in BlueSpice lacks authorization checks in the REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete. Any authenticated user without special privileges can block or unblock arbitrary accounts, including administrators.

QXmlStreamReader can consume disproportionate CPU during parsing of a crafted XML document, causing the application to become unresponsive (denial of service). Exploitation only requires the application to parse attacker-influenced XML; no authentication or user interaction is needed.

When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup. An attacker with access to log files can steal the credentials and use the proxy as the user who configured the proxy settings.