CVE Vulnerability Catalog

Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration atom parsers. A specially crafted MP4 file containing an atom with a declared size smaller than AP4_ATOM_HEADER_SIZE can cause AP4_AvccAtom::Create() or AP4_HvccAtom::Create() to underflow the payload-size calculation. The resulting oversized buffer operation can cause invalid or NULL pointers to be passed to the AP4_DataBuffer copy path, resulting in application termination.

NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__curveDivs() during SVG stroke rasterization. A specially crafted SVG document containing an extremely large stroke-width can cause floating-point rounding to produce a zero subdivision angle. The subsequent arc division yields infinity, which is converted to int without range validation, resulting in undefined behavior and process termination.

Discourse before certain versions allowed Discourse AI reviewables associated with private messages to appear in the moderator review queue of a moderator who was not a participant. Visibility filtering did not restrict access, allowing the moderator to read confidential content and potentially modify the private message by closing the topic or deleting a post.

Termix from version 2.4.0 to 2.5.1 accepted the account password as the sole reauthentication factor in endpoints for disabling TOTP and regenerating backup codes. The refactor regressed the two-factor check, allowing an attacker with a victim's session and knowledge of the password to disable 2FA without access to an authenticator.

Termix from version 1.7.0 to 2.5.1 derived keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt. An attacker with an offline SQLite database copy can derive the wrapping key and decrypt stored SSH passwords, private keys, and key passphrases.

phpMyFAQ before version 4.2.0-alpha is vulnerable to SQL LIKE wildcard injection in the chat user search. An authenticated user can bypass the display-name search filter and enumerate active users, as % and _ are not escaped.

SumatraPDF before version 3.6 has a vulnerability in the MobiDoc::ParseHeader function, where the decoder is sized for a fixed length rather than the actual buffer length. A malformed MOBI file can cause a read beyond a short heap buffer, leading to application crash.

DbGate up to version 7.2.5/7.3.1-premium-beta.1 has a path traversal vulnerability in the fs.readFile function in packages/api/src/controllers/files.js. Manipulation of the filePath/uri arguments allows an attacker to remotely read arbitrary files outside the allowed directory.

A code injection vulnerability was found in DbGate up to version 7.2.5-beta.5 in the JSON Runner component. Manipulating the comment.text/script.schedule arguments in packages/api/src/controllers/runners.js can lead to remote code execution. Upgrading to version 7.2.5-beta.6 mitigates the issue.

A reflected XSS vulnerability exists in the CirrusSearch extension for MediaWiki due to improper input neutralization during web page generation. The issue affects versions up to and including 1.46.0.

An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party controlling name resolution and host responses to write beyond a heap buffer, potentially causing the application to terminate unexpectedly.

A deserialization vulnerability in the command monitoring support of the MongoDB PHP Driver can cause class names from document content to be honored when building monitoring events. An attacker controlling data in database operations may instantiate application classes implementing the persistable interface and invoke their unserialize method.

An out-of-bounds read in libXi's XQueryDeviceState() before version 1.8.4 could be exploited by an attacker. The description is incomplete, but the vulnerability may lead to information disclosure or a crash.

Araxis Merge for Windows versions 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry without sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials stored by the target user.

In the ZBar library, the decode6() function for Code 128 barcodes contains an undefined-behavior vulnerability. When decode_e() returns -1 for an invalid edge pattern, decode6() left-shifts this negative signed value, which is undefined behavior. This can cause a crash (SIGILL) in UBSan builds, leading to denial of service.

libconfini 1.16.4 contains a heap out-of-bounds write condition involving the bundled load_ini_buffer.h utility and strip_ini_cache(). The bundled utility allocates exactly ini_length bytes, while strip_ini_cache() unconditionally writes a NUL terminator at ini_source[ini_length], requiring an additional writable byte.

simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parse_unpadded(). A specially crafted truncated JSON document whose final structural token closes a nested array or object can cause json_iterator::walk_document() to access buf[len] after the input buffer has been exhausted.

Termix versions 1.7.0 through 2.5.1 derive a grep pattern from user-controlled public-key input and interpolate it into shell commands executed on the target host during SSH key deployment. An authenticated user can inject shell syntax and execute commands with the privileges of the selected remote account. The issue is fixed in version 2.5.1.

Termix versions 2.5.0 through 2.5.1 allow authenticated users to configure webhook or ntfy notification channels with attacker-controlled destination URLs and trigger server-side requests via the notification-channel test endpoint. The lack of destination allowlisting or private-address blocking permits blind requests to internal HTTP services. The issue is fixed in version 2.5.1.

Termix versions 1.7.0 through 2.5.1, in the POST /credentials/:id/deploy-to-host endpoint, resolves credential and target-host records from attacker-controlled credentialId and targetHostId values without verifying ownership. Differential errors reveal record existence and authType values, and a key-authenticated victim host can receive an outbound SSH connection attempt using the attacker's public key. The issue is fixed in version 2.5.1.