CVE Vulnerability Catalog

A vulnerability in NVIDIA Infrastructure Controller allows an attacker to cause uncontrolled resource consumption. Successful exploitation might lead to denial of service.

MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org organization name is interpolated directly into a JavaScript string literal without proper output encoding, allowing injection of arbitrary JavaScript. The injected script executes in the context of any authenticated user who loads the page, potentially enabling session hijacking, data exfiltration, or privileged actions.

MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. Due to a logic error in the readFile guard condition in the Xml::build() library, a request containing a bare HTTPS URL can be fetched by the server as a resource. An unauthenticated attacker can send a crafted POST request to the cspReport endpoint to cause the server to issue an outbound HTTPS request to an arbitrary target reachable from the server, enabling scanning of internal services or attacks on internal endpoints.

In MISP, the queryEnrichment method in EventsController.php accepts a module name and iterates over the list of enabled modules. If the module is not found, the code continues with default parameters instead of rejecting the request, allowing an authenticated user to trigger enrichment via a module that was not enabled, bypassing availability controls.

In MISP, the add() method in CollectionsController enforces sharing-group authorization only for POST requests, but CRUDComponent::add() persists data on both POST and PUT. An authenticated user can send a PUT request to collections/add to create a collection with distribution=4 (shared with a specific group) without proper authorization, bypassing the access control.

MISP installer scripts for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4 create a log file at /var/log/misp_install.log and a named pipe (FIFO) at /var/log/misp_install.log.pipe that capture sensitive data including admin, database, GPG, and supervisor passwords. These files are created with the system default umask, resulting in world-readable permissions (typically 0644). Additionally, the log file is not removed before creation, allowing a pre-existing symlink to redirect writes to an arbitrary location. Affected versions are <2.5.47.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoint, allowing an authenticated user to cause excessive database load via a crafted request to {{POST /api/v4/posts/ids/reactions}}. Advisory ID: MMSA-2026-00771.

MISP contains a reflected cross-site scripting (XSS) vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP's json_encode() without hex-encoding flags, allowing an attacker to inject a single-quote character and execute arbitrary JavaScript. The vulnerability affects the Default and UiBeta themes; the Overmind theme is not affected by this specific sink.

A vulnerability was identified in sfturing hosp_order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8. An unknown function in HospitalController.java of the Public Search Handlers component is affected. Manipulation of the Search argument leads to cross-site scripting. The attack can be initiated remotely, and the exploit is publicly available. The project has not responded.

The MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_admin_vendors_ajax AJAX action that allows authenticated attackers with subscriber-level access or higher to retrieve the complete vendor directory. By sending a crafted AJAX request, they can obtain internal user IDs, usernames, and email addresses of all registered vendors, exposing personally identifiable information.

The MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_duplicate_product AJAX action that allows authenticated attackers with subscriber-level access or higher to duplicate any vendor's product by supplying an arbitrary product ID. Attackers can bypass ownership verification, copy any vendor's product listings including private metadata, and assign the duplicate to their own account without the victim's consent.

The MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_send_refund AJAX action that allows authenticated attackers with subscriber-level access or higher to create refund requests against any order by supplying an arbitrary order ID. Attackers can submit crafted AJAX requests to create fraudulent refund requests against orders they did not place, causing marketplace disruption and unauthorized interference.

MISP contains a reflected XSS vulnerability in the attribute histogram view. The $selectedTypes variable, derived from the URL path segment, is interpolated directly into a JavaScript array literal inside an onClick HTML attribute without encoding. An attacker who can cause an authenticated user to visit a crafted URL can execute arbitrary JavaScript in the victim's browser within the MISP origin. Affected version: <2.5.47.

MISP contains a reflected XSS vulnerability in the AnalystDataController::viewForObject action. The method accepts a parent object type parameter from the URL without validation and passes it to the Overmind-themed AnalystData thread view element, where it is interpolated into two translated strings and rendered without output encoding. An authenticated attacker can induce a victim to visit a crafted URL, allowing arbitrary JavaScript execution in the victim's browser within the MISP context. Affected version: <2.5.47.

MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list. In CakePHP, listing an action under unlockedActions disables both CSRF token check and field hash validation. Because moduleStatelessExecution executes a workflow module's exec() method with caller-supplied input and parameters, the absence of CSRF protection allows an attacker to craft a cross-site form post that, when submitted by an authenticated administrator, would invoke the action on the MISP instance. The attacker can select any workflow module, including action modules that write blocklist and warninglist entries, and supply arbitrary input. The vulnerability was found during internal review. The fix is included in MISP v2.5.47.

A path traversal vulnerability was found in changedetection.io up to version 0.60.7, affecting the static_content function in changedetectionio/flask_app.py within the visual_selector_data component. Manipulating the filename argument allows remote exploitation. The exploit has been publicly disclosed and may be used by attackers.

LibreOffice can import PICT images, which may be embedded in documents. An out-of-bounds read occurs when importing an image that uses a colour palette because the palette index is not checked against the number of entries. In fixed versions, the palette index is limited to the entries present.

In LibreOffice, URLs could be constructed that expand environment variables or INI file values, potentially exfiltrating sensitive information to a remote server when opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content provider, so a URL naming it differently still reached the expansion. In fixed versions, the package content provider is matched when the URL is checked.

LibreOffice converts CFF fonts to Type 1 when subsetting a font, which occurs when exporting a document to PDF; CFF fonts may be embedded in documents. A stack buffer overflow exists in this conversion because converted operators are written into a fixed-size buffer without checking if they still fit. In fixed versions, the remaining capacity is tracked and conversion stops when it is used up.

LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow exists when reading the hints of a glyph because the number of hints is checked against the wrong bound. In fixed versions, the hint count is checked against the actual capacity of the array.