CVE Vulnerability Catalog

In libsoup, when handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.

Joomla Extension Balbooa Forms before 2.4.3.4 has an unauthenticated path traversal vulnerability that exfiltrates local files through auto-reply attachments. During public form submission, upload-field state is accepted as Guest-controlled JSON. For every object whose 'id' merely looks numeric, the component trusts the supplied 'filename', concatenates it below the configured upload directory, and adds the result to an array of local attachment paths. It does not load the referenced attachment row, verify ownership/session/form/field, require that the ID exists, canonicalize the path, or enforce containment. If the form's normal 'auto reply' and 'attach uploaded files' options are enabled, the component sends those local paths as email attachments to the address submitted in an email field. A Guest can therefore submit a nonexistent numeric ID plus a traversal filename such as '../../../../configuration.php' and receive any file readable by the Joomla process.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows data excavation. Affects versions from * before 1.46.1, 1.45.5, 1.43.10.

Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows excessive allocation. Affects versions from 1.46.0 before 1.47.0.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - EventBus Extension allows data excavation. Affects version 1.47.0-alpha.

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to execute arbitrary commands on the server.

urllib3 versions from 1.10.3 until 2.8.0 contain an unbounded memory allocation vulnerability. The HTTPResponse.read_chunked and HTTPResponse.stream methods buffer the chunk-size field without a length bound until a newline or EOF is encountered. A malicious HTTP server can send a very long unterminated chunk-size line, leading to exhaustion of the client process memory.

urllib3 versions from 1.26.0 until 2.8.0 fail to keep target-server TLS settings separate from the HTTPS proxy connection. The proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths are affected. Setting cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections may connect to the HTTPS proxy without certificate verification.

TeamViewer Full Client and Host for Linux prior to version 15.82 contain an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in unintended locations.

TeamViewer Full Client, Host, and related modules on Windows, Linux, and macOS contain an improper access control vulnerability. An authenticated remote attacker can bypass user-configured permission settings during session establishment by modifying access control parameters for restricted features. This may result in unauthorized actions and potentially lead to remote code execution.

TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUTHORITY/SYSTEM.

TeamViewer Full Client and Host for Linux and macOS prior to version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user to open a specially crafted session recording through the "Play or convert recorded session…" feature, an attacker may achieve arbitrary code execution with the privileges of the current user.

A malicious remote peer can flood the local QUIC stack with NEW_CONNECTION_ID frames by bypassing a limit on connection IDs. This causes RETIRE_CONN_ID frames to be sent and, with withheld ACKs, can allocate about 400 MB of memory.

OpenSSL 4.0 contains a use-after-free vulnerability (CWE-416) in the caching of X.509 certificate extensions. When several threads concurrently use the same certificate for the first time, one thread may free the cached extension data while another thread is still using it. This can crash the process, resulting in a Denial of Service.

The DTLS retransmission logic incorrectly handles a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer, disclosing heap memory or causing a crash and Denial of Service.

A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was created from. A remote peer may be able to cause a small out-of-bounds read, and in some circumstances a fixed-value out-of-bounds write, on the server heap, potentially leading to a Denial of Service.

A vulnerability in the QUIC implementation in OpenSSL allows a remote attacker to keep allocated packet buffer memory for an extended period by sending specially crafted packets. The issue stems from missing resource allocation limits (CWE-770), potentially leading to excessive memory consumption.

Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation.

Prior to version 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as __proto__ or constructor can resolve through the object prototype chain instead of identifying an actual connected client, causing the Node.js process to crash and resulting in denial of service. Applications that do not use @socket.io/cluster-engine are not affected.

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, users should upgrade to version 0.17.0 or later.