CVE Vulnerability Catalog

A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. Affected is an unknown function of the file /transactionsave.php. Such manipulation of the argument del leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

In TOTOLINK EX200 5.2.3c.7200, the setWiFiAclAddConfig function in /cgi-bin/cstecgi.cgi of the wireless.so component is vulnerable to a stack-based buffer overflow via manipulation of the macAddress argument. The attack can be initiated remotely, and the exploit has been made available to the public and could be used for attacks.

In TOTOLINK EX200 5.2.3c.7200, the setStaticDhcpConfig function in /cgi-bin/cstecgi.cgi of the lan.so component is vulnerable to a stack-based buffer overflow via manipulation of the Comment argument. The attack can be launched remotely, and the exploit has been released to the public and may be used for attacks.

A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /orderdetail.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

A vulnerability in the Perl Robots::Validate library (versions 0.4.3 to 0.4.10) allows the state of the Aho-Corasick matcher used for User-Agent matching to persist across requests. If a User-Agent ends partway through a robot name, the next User-Agent checked by the same object can complete that name, causing misclassification of the client as a robot.

Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call jpeg_write_marker() for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte before checking the exhausted free_in_buffer counter, which then wraps and permits the attacker-controlled comment and subsequent compressed image data to overwrite adjacent heap memory. Re-saving an untrusted image as JPEG while preserving its ICC profile and forwarded comment can crash the process and may enable code execution in suitable runtime and heap layouts. This issue is fixed in version 13.0.0.

Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler, which sizes a DIB allocation from 16-bit-truncated dimensions but copies pixel data using the original full dimensions, allowing a heap buffer over-read.

In Pillow from 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. Because src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, a file filled with repeated headers causes a new shrinking copy on every iteration and quadratic CPU work. The condition is reachable through Image.getexif(), Image._getexif(), and ImageOps.exif_transpose(), including common photo-upload rotation workflows. This issue is fixed in version 13.0.0.

In Pillow prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consumes a full CPU core, and never returns. TarIO is reached only when an application directly uses PIL.TarIO.TarIO rather than the default Image.open() path. This issue is fixed in version 13.0.0.

Pillow, a Python imaging library, prior to 13.0.0 has a flaw in PILfont text-width accumulation in src/_imaging.c where positive glyph advances are checked against INT_MAX but negative advances are not checked against INT_MIN. Repeating a signed 16-bit advance of -32768 can execute a signed C integer overflow in xsize += dx, producing a large positive width from a negative mathematical result, which can cause logic-integrity errors or resource consumption in applications using getlength(), getsize(), or derived layout, quota, serialization, or allocation calculations.

Pillow versions 5.1.0 through 13.0.0 fail to track duplicate indirect references in a PDF /Pages graph. A compact malformed PDF can cause exponentially many page references and disproportionate CPU consumption when Image.save with append=True processes an attacker-controlled PDF.

Pillow versions 11.0.0 through 13.0.0 mishandle multi-frame images (PSD, MPO, DCX, MIC). When a later frame switches to a wider mode (RGB/CMYK), the stale narrow-mode buffer is reused, causing out-of-bounds writes and crashes, and in some runtime profiles command execution.

Pillow, a Python imaging library, from 9.1.0 until 13.0.0 allows BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py to append beyond the remaining dest_length without a per-branch cap via crafted RLE BMP delta escapes and absolute-mode runs. A delta can add roughly 255 image rows in one iteration, so a kilobyte-sized file with a large but permitted width can expand the data bytearray to hundreds of megabytes or more, causing memory-exhaustion denial of service.

In Pillow prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size without rerunning Image._decompression_bomb_check(). A tiny file can use a safe first frame to pass Image.open() and then declare very large dimensions in a later mode F frame. Loading that frame allocates approximately four bytes per attacker-declared pixel and can consume multiple gigabytes of memory. This issue is fixed in version 13.0.0.

Pillow, a Python imaging library, prior to 13.0.0 allows MpoImageFile.seek() and DcxImageFile.seek() to reparse later MPO or DCX frames and replace self._size without rerunning Image._decompression_bomb_check(). A crafted multi-frame image can use a tiny first frame to pass Image.open() and then declare an over-limit later frame, which during normal frame iteration through seek(), load(), or ImageSequence.Iterator can decode that frame and commit hundreds of megabytes or more, causing memory-exhaustion denial of service.

A screen capture endpoint in the vCast media streaming service in ViewSonic ViewBoard allows a remote, unauthenticated attacker to capture and exfiltrate the current screen content. GET requests to unauthenticated /snapshot or /screen endpoints return JPEGs.

TastyIgniter through 4.4.5 contains a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute() when the setting is read. Attackers can submit a serialized gadget chain, such as one generated via phpggc, through the admin settings form (for example the maintenance_message setting loaded by CheckMaintenance.php) to achieve arbitrary operating-system command execution as the PHP application process user, with the impact persisting until the value is overwritten.

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities that signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could exploit this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by TLS/SSL clients using the system CA store. Due to the inability to distrust only specific intermediate certificates in all clients, root CA certificates of authorities that signed weak intermediate certificates are being removed.

A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. Impacted is an unknown function of the file /inserttrans.php. Performing a manipulation of the argument prcd results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument output_path causes file inclusion. Remote exploitation of the attack is possible. Patch name: 1d42459c292f89e412f7f6243829e7fed2e85bf5.