CVE Vulnerability Catalog

A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bones_num results in heap-based buffer overflow. The attack can be executed remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A security vulnerability has been detected in Open Asset Import Library Assimp 17c12da. The impacted element is the function Assimp::MDLImporter::GenerateOutputMeshes_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component 3DGS MDL7 Model Output Mesh Generator. The manipulation leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A weakness has been identified in Open Asset Import Library Assimp 17c12da in the function Assimp::MDLImporter::ReadFaces_3DGS_MDL7 in the file code/AssetLib/LWO/LWOLoader.h of the 3DGS MDL7 Model Parser component. Manipulation can lead to a heap-based buffer overflow. The attack can be launched remotely, and the exploit is publicly available.

A security flaw has been discovered in Open Asset Import Library Assimp 17c12da in the function Assimp::Compression::decompressBlock of the file code/Common/Compression.cpp of the File Parser component. Manipulation results in a heap-based buffer overflow. The attack can be initiated remotely, and the exploit has been released publicly.

A vulnerability was identified in CodeCanyon TimeCamp Integration for CRM up to version 2.8. This issue affects some unknown processing of the file /clients/save_contact of the Contact Information Update component. Manipulation of the argument contact_id leads to authorization bypass. The attack can be launched remotely, and the exploit is publicly available.

A vulnerability was found in Jij-Inc Jij-MCP-Server 0.1.0. This affects the function PythonREPL.run of the file jij_mcp/python_repr.py of the jm_check component. Manipulation of the argument code results in code injection. The attack can be launched remotely, and the exploit has been made public.

A security flaw was discovered in iatsiuk pptr-mcp up to 0.2.7. It affects the executeCode function in src/vm-executor.ts of the execute Tool component. The manipulation results in code injection. The attack can be launched remotely and the exploit is public.

A vulnerability was identified in graphlit graphlit-mcp-server 1.0.1. It affects the fetch function in src/tools.ts of the ssrf-test Endpoint component. Manipulating the url argument leads to server-side request forgery. The attack can be launched remotely and the exploit is public.

A vulnerability was found in gomarble-ai facebook-ads-mcp-server 0.1.0. It affects the fetch_pagination_url function in server.py. The manipulation leads to server-side request forgery. The attack can be launched remotely. A patch is available with ID 4e53875aa22e8991c2fa4a7660d86e1caba66659.

OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree.

Scriban before 7.0.0 (affected versions <= 6.6.0) contains a denial-of-service vulnerability in which the LimitToString safety limit (default 1MB) can be bypassed because ObjectToString resets the per-call length counter (_currentToStringLength) on every top-level call and StringBuilderOutput enforces no cumulative output-size limit. An attacker who can supply a template can render a near-limit string repeatedly in a loop, allocating approximately 1GB of memory and causing an out-of-memory condition that crashes the host application.

Scriban before 7.0.0 contains three distinct denial-of-service vulnerabilities in expression evaluation that bypass existing safety controls through unbounded string multiplication, uncontrolled BigInteger shift operations, and LoopLimit bypass via range enumeration in builtin functions. Attackers who can supply templates can cause out-of-memory exceptions or CPU exhaustion, typically terminating the entire host process.

stoatchat before 0.15.0 contains a permission bypass vulnerability in the message_fetch route that checks only ViewChannel permission instead of requiring ReadMessageHistory. Attackers with ViewChannel access but ReadMessageHistory denied can retrieve individual message content by ID, bypassing the intended history restriction enforced by bulk read routes.

stoatchat versions before 0.15.0 fail to block the IPv6 unspecified address (::) in the SSRF blocklist, allowing unauthenticated attackers to bypass protections via the /proxy and /embed endpoints. Attackers can craft requests using IPv6 literal syntax to access services on the loopback interface and retrieve sensitive internal content.

Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_require. smart_require stores results in a process-global hash with no bound and no eviction, and keeps an entry for every class name it is asked about, including names that failed to load, because the return value of the failed eval is stored before the error is checked. The key comes off the wire on the server side: _signature_method_class builds the class name from the signature_method parameter of the incoming message, and verify resolves it before any signature is checked. A remote client chooses both how many entries are created and how long each key is. In a persistent server the hash grows for the life of the worker process until it exhausts memory. Header size limits bound the key length on the Authorization header path, but not on a POST body.

The Bold Page Builder plugin for WordPress up to version 5.6.8 is vulnerable to Stored Cross-Site Scripting via the 'bt_bb_shortcode' shortcode. Authenticated attackers with contributor-level access can inject arbitrary scripts that execute when a user visits an injected page.

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress up to version 6.1.1 is vulnerable to authorization bypass, allowing authenticated attackers with custom-level access to read arbitrary user metadata and sensitive user record fields, including email address, roles, registration date, and user_meta values, belonging to any user including administrators.

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress up to version 7.10.09 is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation. Unauthenticated attackers can trick an administrator into performing an action that deletes arbitrary WordPress options, including critical ones such as siteurl, home, active_plugins, template, and stylesheet, causing site outage or a full plugin and theme reset.

The Kirki plugin for WordPress up to version 6.1.1 is vulnerable to Directory Traversal via the 'data' parameter. Authenticated attackers with editor-level access and above can read arbitrary files on the server, including sensitive information, by bypassing the strpos()-based guard with traversal sequences in the URL.

The Forminator Forms plugin for WordPress up to version 1.55.0.2 is vulnerable to Insecure Direct Object Reference via the 'draft' parameter. Unauthenticated attackers can enumerate sequential entry IDs and read other users' saved draft data, including names, emails, phone numbers, and message content, when the 'Save and Continue' feature is enabled.