CVE Vulnerability Catalog

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter. The filter invokes non-string arrow arguments as callables without the checkArrow guard, allowing authenticated users to pass an array-callable such as FileHelper::writeToFile.

Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the _Session class when creating sessions. An authenticated user or anyone holding that user's session token can send POST requests to /sessions or /classes/_Session to create additional sessions and add fields to _Session; these sessions are not revoked when the original session is logged out.

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, when passwordPolicy.maxPasswordHistory or doNotAllowUsername is set, guessed current or previous passwords, bypassing account lockout.

ptbsare anx-calibre-manager up to 1.13.12 has a server-side request forgery vulnerability in LLMClient.chat in blueprints/api/llm.py via the base_url argument. The attack can be initiated remotely and the exploit has been published.

A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.

A vulnerability was found in clientst0r up to version 3.17.586 in the _fetch_html function of locations/services/property_url_importer.py (Property URL Importer component). Manipulation of the url argument results in server-side request forgery, and the exploit has been made public and can be launched remotely.

markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.

The CVE was rejected — the candidate was in a CNA pool that was not assigned to any issue. There is no actual vulnerability to analyze.

A flaw was found in GIMP where importing a crafted SBZ palette without a color-model attribute causes a NULL pointer dereference during string comparison. This results in denial of service of the GIMP application.

A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. The xp_cmdshell function in /ws.asmx mishandles the sql argument, leading to SQL injection. The attack may be remote and the exploit has been publicly disclosed.

A vulnerability was detected in clawhost up to version 0.0.45 in the handleRequest function of apps/clawhostgo/src/main/services/reverseProxy.ts (Reverse Proxy component). Manipulation of the token argument results in open redirect, the attack can be initiated remotely, and the exploit is now public.

A vulnerability was detected in grandnode grandnode2 up to 2.3.0. It affects the Html.Raw function in the file src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml in the Product Description Handler component. Manipulation leads to cross-site scripting (XSS). The attack can be launched remotely. Upgrading to version 2.4.0-beta or 2.4.0 addresses the issue.

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input, and each buffered value revalidates the rest of the buffer.

Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys written out as Latin-1 characters.

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv. A decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references, so a filter that removes the last single-key filter frees the callback table while the decode is in progress.

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag. With allow_tags, the class name and argument array are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated.

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify. For an array or hash object with a "" overload, and from 4.20 a scalar object, it takes an extra reference that is never released.

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse. The bytes 12 decode as one value when read together, but as 1 and then 2 when split across two reads.

Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread. Callbacks and the incremental parse buffer are copied as raw scalar pointers, so the child's parser uses and later frees scalars that belong to the parent.

A vulnerability in the Cpanel::JSON::XS Perl library (versions 4.20 to 4.80) causes an out-of-bounds write during canonical encoding of a tied or threads::shared hash when the key count grows between the first and second pass. This can corrupt stack or heap memory and crash the process.