CVE Vulnerability Catalog

pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerability in dimensional patch WKB deserialization that allows authenticated database users to read adjacent heap memory. Attackers can supply crafted pcpatch values with attacker-controlled size fields to copy heap memory into stored patches for exfiltration or crash the PostgreSQL backend.

CliInvoke (and its formerly named AlastairLundy.CliInvoke) are .NET libraries for invoking command-line programs. Versions 2.0.0-2.8.4, 2.9.0-2.9.3, 2.10.0-2.10.4, 3.0.0-alpha.1-3.0.0-beta.1 (CliInvoke) and 2.0.0-alpha.1-2.0.0 (AlastairLundy.CliInvoke) contain an argument-injection vulnerability in `RunnerProcessFactory` (2.x line) and `RunnerConfigurationFactory` (3.x line). These factories combine runner arguments, a caller-controlled target, and caller-controlled arguments into one `ProcessStartInfo.Arguments` string, allowing a double quote to break quoting and inject unintended elements into the runner's argument vector, potentially resulting in arbitrary command execution.

Ciena Navigator Network Control Suite (NCS) contains an information exposure vulnerability in an event-streaming API that does not properly enforce authentication. An unauthenticated attacker with network access to the affected service could access the event stream and potentially obtain sensitive information.

ClipBucket v5 before 5.5.3-#197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with manage_template_access permission can traverse outside the layout directory to modify executable PHP files and achieve remote code execution as the web server user.

The .NET library CliInvoke.Specializations (and AlastairLundy.CliInvoke.Specializations) contains an OS command injection vulnerability in its PowerShell and Cmd wrappers. The wrappers pass a caller-controlled target and arguments to `pwsh -Command` or `cmd /c` using a single `ProcessStartInfo.Arguments` string, allowing a double quote in untrusted input to break OS-level quoting and execute an additional command with the host process's privileges.

GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTOR_PREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTOR_PREFIX to a directory containing a malicious plugin that executes arbitrary code with elevated privileges when loaded by a setuid or setgid program.

Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind roles, or delete users via POST /sys/user/update and POST /sys/user/delete endpoints.

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is already stored in the system. An attacker can create their own certificate using the name of a real, previously trusted sender and use it to send a forged email. Zammad will display that email with the same "validly signed" indicator as a genuine message from the real sender, even though the attacker never had access to that sender's actual certificate or private key. This issue is fixed in version 7.1.2.

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's External Data Source feature, used to look up records from an external system, did not properly verify whether a user was allowed to see a specific ticket, user, group, or organization before including its details in a request to that external system. An authenticated user, including one with only basic customer access, could exploit this by referencing another record's ID, and thereby view details of tickets, customer accounts, teams, or organizations that did not belong to them. This issue is fixed in version 7.1.2.

GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version 11.0.8.

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. This issue is fixed in versions 11.0.8 and 10.0.26.

GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant access to a document without confirming that the document is linked to the targeted item. A user can use an unrelated item that the user is permitted to view to read a document linked to an inaccessible item. This issue is fixed in version 11.0.8.

In GLPI, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy REST API interface or SSO logins, this can change a super-administrator's authentication method and enable account takeover. The issue is fixed in versions 11.0.8 and 10.0.26.

In GLPI, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL triggers reflected cross-site scripting in the dashboard. The issue is fixed in version 11.0.8.

In GLPI, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against the MFA verification flow, making brute-force compromise of the second factor and subsequent account takeover possible. The issue is fixed in version 11.0.8.

In GLPI, any logged-in user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. The issue is fixed in versions 11.0.8 and 10.0.26.

A flaw was found in the CloudClassroom-PHP-Project in an unknown function of the file updatefaculty.php. Manipulation of the fid argument leads to SQL injection. The attack can be initiated remotely and the exploit has been publicly disclosed.

A security vulnerability was detected in the CloudClassroom-PHP-Project in an unknown function of the file updatequery.php. Manipulation of the gid argument leads to SQL injection. The attack can be initiated remotely and the exploit has been publicly disclosed.

A weakness was identified in the CloudClassroom-PHP-Project in an unknown function of the file loginlinkfaculty.php of the Faculty Authentication component. Manipulation of the fid/pass arguments leads to SQL injection. The attack can be initiated remotely and the exploit has been publicly disclosed.