CVE Vulnerability Catalog

The webhook platform gateway in Nous Research Hermes Agent builds the session chat_id as webhook:{route_name}:{delivery_id} and re-derives the authorizing route by splitting that string. A route name containing a ":" resolves toolset authorization to a different, higher-privileged prefix route than the one authenticated.

Velneo vServer contains an improper link resolution before file access ('link following') vulnerability. This issue affects vServer from 32.3 before 36.6 and from 37.1 before 37.2.

In the PathResourceManager component of the Undertow web server, the mechanism verifying whether a symbolic link points to a safe location only checks if the target path starts with a specific string, without ensuring it matches a full directory name. This could allow an attacker to access files in a sibling directory whose name starts with the same characters as an authorized safe directory.

A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The readfile function in download.php is affected by manipulation of the ID argument leading to SQL injection; the attack may be performed remotely and a public exploit exists.

A SQL injection vulnerability was identified in file-management-system-php within the save_folder, delete_folder, delete_file, file_rename, and save_files functions of admin_class.php (Folder Management component). Manipulating the name/parent_id/id/type/folder_id/description arguments allows SQL injection. The flaw can be exploited remotely and a public exploit is available.

In oretnom23 file-management-system-php, the save_user function in admin_class.php (User Account Management component) is vulnerable to SQL injection via manipulation of the name/username/password/type/id arguments. The attack is remote and a public exploit has been released.

A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the Login function in admin_class.php. Manipulation of the username/password argument leads to SQL injection. Remote exploitation is possible, and the exploit is publicly available and might be used. The product follows a rolling release approach, so version details are not provided. The project was informed but has not responded yet.

A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element is the function include of the file index.php. Executing a manipulation of the argument page can lead to file inclusion. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large number of filters or multiple filters that pass around large amounts of data can cause large memory consumption. This issue is fixed in version 6.20.0.

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, an attacker can craft an incomplete PDF that ends inside a standard cross-reference table, causing pypdf to mishandle the unexpected end of file and enter an infinite loop. This issue is fixed in version 6.20.0.

pypdf before version 6.20.1 can enter an infinite loop when removing an object from a crafted cyclic PDF tree, such as an outline item, blocking the current process. The issue is fixed in version 6.20.1.

pypdf before version 6.20.1 can enter an infinite loop when calling PdfWriter.find_outline_item on a crafted PDF with a cyclic outline hierarchy, blocking the current process. The issue is fixed in version 6.20.1.

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing a content stream with many small operations, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0.

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing arrays or dictionaries with many elements, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0.

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long runtimes when an application retrieves the document's form fields. This issue is fixed in version 6.21.0.

A vulnerability in the ssh service in Lagoon core (versions prior to 2.33.1) allows an attacker to execute arbitrary code, potentially leading to elevated administrative permissions. It requires a Lagoon user account; fixed in Lagoon v2.33.2 (helm chart lagoon/lagoon-core v1.62.2).

The odf-kit library versions 0.6.0 through 0.14.2 has an escapeHtml() helper applied to text content and attributes but not to inline CSS strings. In renderTextSpan and roughly ten other emission sites, values such as fo:color are copied verbatim from the document and concatenated raw into the style attribute, allowing injection via a quote character in the value.

Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length.

Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the GPS receiver's serial data to crash ntpd or disclose memory via a PPS Control (@@Gc) reply with an out-of-range mode byte.

Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt memory or crash ntpd via more than six time replies.