CVE Vulnerability Catalog

ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile() function fails to update the file extension after MIME validation, allowing a .php extension to persist and execute via PHP-FPM.

vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM. The sanitizer leaves crypto.setFips callable, allowing guest code to change the FIPS mode of the entire host process, crossing the NodeVM isolation boundary. Fixed in vm2 3.12.1.

rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING with content exactly [0x00], causing an underflow and panic. Reachable via BorrowedCertRevocationList::from_der() when a CRL contains an issuingDistributionPoint extension with such an onlySomeReasons value. Requires an application that opts in to CRL revocation checking and parses attacker-influenced CRL bytes; default rustls configuration is unaffected. Fixed in 0.103.13 and 0.104.0-alpha.7.

ArcadeDB (com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: HostClassLookupFilter.DENIED lists java.util.ResourceBundle as a bare class name, not covering subclasses, while ScriptTriggerExecutor.ALLOWED_PACKAGES permits java.util.*. A user with UPDATE_SCHEMA privilege can reference java.util.PropertyResourceBundle or java.util.ListResourceBundle and invoke ResourceBundle.getBundle(String) to read .properties resources from the application classpath, disclosing sensitive configuration data. Fixed in 26.9.1.

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services and cloud metadata endpoints.

ArcadeDB (com.arcadedb:arcadedb-engine) through 26.8.1 enforces per-type/per-record access-control rules only in LocalBucket, keyed on file id. Query paths reaching data through LSM index files or the TimeSeries engine never invoke that check, so an authenticated user denied readRecord/deleteRecord can still read indexed key values, record IDs, MAX/MIN values, TimeSeries samples, learn record counts, and delete index entries, desynchronizing the index from data. Index and type names are discoverable via SELECT FROM schema:indexes. Affects embedded and server deployments and all transports. Fixed in 26.9.1.

ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but TimeSeries types do not own normal record buckets. An authenticated low-privilege user can read or insert TimeSeries samples despite explicit deny rules by exploiting the missing type-name-based access check that causes permission lookups to fail open.

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side assertion that poisons the GPU context, causing all subsequent requests to fail until the process restarts.

SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without escaping single quotes. A publish-mode reader or anonymous visitor can inject SQL via inline HTML span tags in the getGraph endpoint to execute arbitrary queries on the read-write database and exfiltrate private data across notebooks.

A flaw in the Netty STOMP codec. A remote attacker can send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability can lead to an infinite decode loop.

NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted via POST is received and fopen() opens the URL in binary read-only mode, then the content is written to /tmp/ with a filename derived from basename() of the URL. This operation requires no authentication.

NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handle_import_privilege.php.

Improper handling of length parameter inconsistency vulnerability in ABB Freelance Controller DCP, AC700, AC800, and AC900. This issue affects versions through 2013, 2013 SP1, 2016, 2016 SP1, 2019, and 2019 SP1.

A flaw in Netty's HttpServerCodec allows a remote, unauthenticated attacker to pipeline HTTP/1.1 requests and withhold reads, causing the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and denial of service.

In Netty, SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and denial of service.

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could bypass the cryptographic signature verification step of a privileged support command by supplying a specially formed access credential. Successful exploitation grants the attacker an unrestricted root shell with full control over the Flex appliance host and all hosted containers, completely compromising confidentiality, integrity, and availability.

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could supply a specially crafted input to a privileged administrative command, causing it to execute arbitrary code with root-level permissions. Successful exploitation grants the attacker unrestricted control over the Flex appliance host and all hosted containers, fully compromising confidentiality, integrity, and availability.

A flaw in Netty's MqttDecoder. An unauthenticated remote attacker can send a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the 'Properties Length' against the 'Remaining Length', allowing bypass of size limits.

A flaw in Netty's `RedisArrayAggregator` component. A remote attacker can send specially crafted nested Redis (RESP) array headers. This causes `RedisArrayAggregator` to eagerly preallocate a large amount of heap memory.

A flaw in Netty's `SmtpResponseDecoder` component. A remote attacker acting as a malicious or man-in-the-middle (MITM) SMTP server can send a specially crafted, unbounded multi-line SMTP response without a terminator. This leads to unbounded memory accumulation within the client's JVM heap.