CVE Vulnerability Catalog

A SQL injection vulnerability was identified in girishsaraf Online-Appointment-Booking-System in the book.php file of the Booking Handler component. Manipulation of the Doctor/appointment argument allows remote attacks, and the exploit has been made publicly available.

A flaw was found in SSSD where the service fails to verify the presence of the SID extension before processing it in deployments configured with SID-based certificate mapping rules. A remote attacker can submit a certificate lacking the expected SID extension, causing the process to crash during authentication or lookup operations.

A flaw was found in SSSD where a local attacker can send a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process.

The NFS idmap plugin in SSSD fails to abort after detecting that a cached entry exceeds the destination buffer size, leading to an out-of-bounds write. A local attacker can trigger this by requesting identity lookups that resolve to oversized cached entries, causing a crash of the identity mapping service (DoS) and potential corruption of adjacent process memory.

In the Kerberos Credential Manager (KCM) responder in SSSD, the service fails to release cached objects from memory when credentials are removed. A local user can maintain a persistent connection and repeatedly store and destroy credentials, causing continuous memory growth and ultimately exhausting available memory, rendering the service unresponsive (DoS).

A use-after-free vulnerability exists in the Kerberos Credential Manager (KCM) responder in SSSD during Kerberos ticket-granting ticket (TGT) renewal, where a deferred callback accesses memory that has already been released. An authenticated local user with a renewable Kerberos ticket can trigger this issue, causing the KCM responder service to crash and resulting in a Denial of Service (DoS).

In SSSD, when configured to enforce account expiration using LDAP shadow attributes, an expiration value of zero is not treated as an expired account. A user with valid credentials for an expired account can exploit this flaw to bypass access controls and authenticate to the system, allowing unauthorized access after the account was intended to be deactivated.

In SSSD, an unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing authorization checks. This triggers global cache invalidation and forces repeated lookups to backend directory providers, leading to a Denial of Service (DoS) from degraded automount availability and elevated resource consumption.

In SSSD, when the autofs responder service is enabled, memory allocated during successful request processing is not released until the client connection terminates. A local attacker can exploit this by maintaining an open connection and repeatedly submitting valid requests, leading to memory exhaustion and a Denial of Service (DoS).

Joplin Server prior to 3.7.2 stores CSRF, account-confirmation, email-change, and password-reset tokens without a purpose, and UserModel.resetPassword accepts any token returned by TokenModel.userFromToken. An attacker who obtains a victim's CSRF or confirmation token through a separate disclosure channel can submit it to the public password-reset endpoint, replace the victim's password, and cause the existing sessions and API applications to be deleted. This issue is fixed in Joplin Server 3.7.2.

In Joplin prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components to render card content with the full Markdown renderer, and the components insert the resulting HTML into the main application document through dangerouslySetInnerHTML. A malicious note can inject style elements and remote CSS imports that modify trusted application chrome, signal when the note is opened, and potentially disclose exposed attribute values. Content Security Policy blocks inline script execution, so the supported impact is CSS injection and UI redressing rather than code execution. This issue is fixed in version 3.7.13.

In vLLM before 0.30.0, a caller can use the media_io_kwargs field to select the GLMGA video backend and supply large fps and max_frames values without a strict work ceiling, causing disproportionate CPU and memory consumption.

In vLLM before 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label, allowing an unauthenticated attacker to send unique arbitrary method tokens and cause permanent creation of label sets, increasing memory usage.

In vLLM from 0.24.0 to 0.30.0, the Qwen2VLVideoBackend and Qwen3VLVideoBackend classes accept request-level values for max_frames and fps without server-side ceilings, allowing an unauthenticated caller to decode every frame from attacker-controlled video and consume disproportionate memory.

In vLLM before 0.30.0, structured-output request failures can escape validation and reach the EngineCore fatal-error path, allowing ordinary constrained-generation requests to terminate the shared engine.

In vLLM before 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing character and length restrictions, which can raise an uncaught ValueError during scheduler cache lookup, causing EngineCore to terminate.

In vLLM before 0.30.0, flash late-interaction scoring at /score and /rerank derives query_key from the caller-controlled X-Request-Id header, allowing a concurrent request to overwrite the cached query embedding of a victim.

In vLLM before 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors, cache identifiers, ranges, and wire-selected multimodal field processors without rebinding them to the active model renderer contract, which can terminate EngineCore, poison cache, or alter transport semantics.

In vLLM before 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during rendering and before engine admission, while the receiver cache never receives the payload if the request is rejected, causing an assertion error on later reuse.

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.