CVE Vulnerability Catalog

The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list was incomplete and omitted 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, and fe80::/10, as well as IPv4-mapped IPv6 forms, allowing an authenticated user to direct requests to internal addresses from the MISP server's network context.

A weakness has been identified in H3C Magic NX15 V100R017 affecting the importprofile function in the /api/upload file. Manipulation of the fileName argument causes path traversal, the attack can be initiated remotely, and the exploit has been made publicly available.

In H3C Magic NX15 NX15V100R017, the write function of /api/esps in the RPC Interface allows manipulation of the path argument to lead to code injection. The attack can be executed remotely, and the exploit has been publicly disclosed.

In H3C Magic NX15 100R017, the function sub_416874 in /usr/bin/usrlist allows OS command injection. Remote exploitation is possible, and the exploit has been made public.

IBM Storage TS4500 Library and IBM TS4500 Tape Library/Diamondback Tape Library versions 1.1.1.6 through 1.12.0.3 do not invalidate sessions, which could allow an authenticated user to impersonate another user on the system.

IBM Storage TS4500 Library versions 1.1.1.6 through 1.12.0.3 does not invalidate the session after logout, which could allow an authenticated user to impersonate another user on the system.

IBM Storage TS4500 Library and IBM Diamondback Tape Library versions 1.1.1.6 through 1.12.0.3 could allow an authenticated user to cause a denial of service using specially crafted SMTP requests that consume excessive amounts of system resources.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vulnerability information is available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vulnerability information is available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vulnerability information is available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vulnerability information is available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vulnerability information is available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vulnerability information is available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vulnerability information is available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vulnerability information is available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vulnerability is associated with it.

MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend. An unauthenticated attacker can submit a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint, causing trace_info.yaml, request_metadata and tag files to be written outside the intended experiment trace directory (within the server process's filesystem permissions). FileStore was the default backend before MLflow 3.7.0 and is opt-in thereafter.

Pillow prior to 13.0.0 is vulnerable to regular-expression denial of service in its XBM header parser. Calling Image.open() on a small crafted XBM file causes a backtracking expression to be applied to the attacker-controlled header, stalling a worker for minutes.

Pillow, a Python imaging library, from 2.6.0 until 13.0.0 is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a hyphen can be interpreted as a Ghostscript option.

Pillow from 9.1.0 until 13.0.0 can disclose uninitialized stack memory when Image.quantize() uses an empty palette. ImagingPaletteCacheUpdate() leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as output pixel indices in a returned PNG or GIF.