CVE Vulnerability Catalog

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.

Missing Authorization vulnerability in Interprobe Information Technologies Inc. Qorela DC allows Privilege Abuse. This issue affects Qorela DC: from 1.6.1-RC29 before v1.6.2.

The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade to version 2.3.3.

Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3.

Apache XmlSchema does not limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. The issue is fixed in version 2.3.3.

Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting by an incorrect buffer size calculation, causing out-of-bounds reading.

SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service.

Crash in the SPDY protocol dissector in versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service.

GitLab CE/EE has a vulnerability allowing arbitrary JavaScript execution in another user's browser session due to improper sanitization of path components in the merge request diff viewer. Affects versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1.

Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet, which can be used for configuration file upload, leading to information disclosure and integrity compromise. The servlet is intended for testing in non-production environments.

A security vulnerability in HPE OneView may be exploited remotely to perform session hijacking, data theft, or other unauthorized actions.

A potential security vulnerability in HPE OneView can be exploited to allow remote session hijacking or other unauthorized actions.

Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. The application searches for resource files in predictable paths under C:\gs\ that do not exist by default, and Windows default ACLs allow any authenticated user to create directories at the root of C:\. An attacker can create the expected directory structure and plant a malicious PostScript file, which is executed with full privileges of the Ghostscript process. Fixed in version 10.08.0.

Path Traversal vulnerability in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via the path parameter.

Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter.

Apache Karaf has a vulnerability in JMX MBeanServer security, where createMBean, registerMBean, and unregisterMBean operations are not subject to RBAC. This allows a user with the 'viewer' role to achieve remote code execution in the Karaf JVM by using MLet as a remote classloader.

In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content. Insecure deserialization of this content allows arbitrary code execution in the Octopus Server process.

Missing authentication in the local .NET backend (Fiddler.WebUi) of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel.

A vulnerability was identified in tacomall 1.0.0 in the OrgStaffServiceImpl.add function of ApiMaApplication.java in the api-admin Backend component. Manipulation of the isAdmin/jobId arguments leads to improper authorization. Remote exploitation is possible and the exploit is publicly available.