CVE Vulnerability Catalog

Helium before version 2.2.60 allows any authenticated user to submit an arbitrary URL to POST /feed/externalcalendars/. The server uses validate_url only to check syntax, then fetches the URL via urllib.request.urlopen, enabling forced outbound requests and internal service reconnaissance.

In OpenPrinting CUPS, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able to write that directory, predict the connection-derived name, and plant a symlink before the root open, while a privileged add-printer or modify-printer operation using a model PPD triggers copy_model(). Fixed in version 2.4.20.

In OpenPrinting CUPS before 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. These mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument, allowing a user permitted to submit a job to inject control characters into the downstream option stream.

In OpenPrinting CUPS before 2.4.20, the quote_string() function in backend/ipp.c preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD control line and persist an attacker-selected PPD keyword.

In NL Portal Backend Libraries, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL resolvers are reachable without CommonGroundAuthentication and forward a caller-influenced URL through ObjectenApiService.getObjectByUrl to ObjectsApiClient.getObjectByUrl, which attaches the privileged Objecten-API token. The host-equality check restricts requests to the configured Objecten-API host but does not constrain the scheme, port, or path. The 3.0 line is fixed in 3.0.4; the advisory does not identify a fixed 3.1 release.

The bincookie library (a header-only binarycookies parser) prior to version 0.1.9 contains a heap buffer overflow in bincookie_init_file(). The function allocates a buffer based on the actual .binarycookies file length but uses the file-controlled num_pages field as the loop bound for byte-swapping page_sizes entries, allowing reads and writes beyond the heap allocation. Related unvalidated page sizes and cookie_offsets can drive additional out-of-bounds accesses.

Discourse ActivityPub prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5 does not sufficiently verify that the actor authenticated by the signed request matches the Activity actor and owns the referenced federated post. These missing identity and ownership checks allow a remote attacker to edit, delete, or reply to federated posts without the required permissions.

In NL Portal Backend Libraries, both the getDocumentContent GraphQL query and the GET /api/documentapi/{documentapi}/document/{documentId}/content REST route allow any authenticated portal user to retrieve a document without checking ownership of or another authorized relationship to it. A user with a valid login and another person's document identifier can read that document's contents, which may include sensitive personal information. Fixed in version 3.0.3.

A remote code execution vulnerability in the rlottie library used by Telegram, caused by lack of proper validation of user-supplied data, resulting in a write before the start of an allocated buffer. Exploitation requires user interaction — visiting a malicious page or opening a malicious file.

The WordLift plugin for WordPress contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects WordLift from n/a through 3.54.15.

The JetSmartFilters plugin by Crocoblock contains a Cross-site Scripting vulnerability (improper neutralization of input during web page generation) that allows Stored XSS. This issue affects JetSmartFilters from n/a through 3.8.6.

The AI Engine plugin by Meow Apps contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects AI Engine from n/a through 3.8.3.

The Simply Schedule Appointments plugin by NSquared contains an Authorization Bypass Through User-Controlled Key vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Simply Schedule Appointments from n/a through 1.6.12.35.

The Strong Testimonials plugin by WP Chill contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Strong Testimonials from n/a through 3.3.12.

The APIExperts Square for WooCommerce plugin by WPExperts contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects APIExperts Square for WooCommerce from n/a through 4.7.5.

The MDTF (wp-meta-data-filter-and-taxonomy-filter) plugin by PluginUs.Net contains a Cross-site Scripting vulnerability (improper neutralization of input during web page generation) that allows Stored XSS. This issue affects MDTF from n/a through 1.4.0.

XXL-JOB up to 3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the job log list page (/joblog). An authenticated user with permission on a target executor job group can inject arbitrary JavaScript via the executorParam argument of the manual-trigger endpoint POST /jobinfo/trigger.

XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS) in the GLUE code editor. JobCodeController.save() stores the user-supplied glueSource parameter without output encoding, and the FreeMarker template job.code.ftl renders the stored value unescaped.

tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed location, causing an infinite loop and denying service to a program that reads the crafted file. This issue is fixed in version 2.3.0.

In @libp2p/webrtc prior to 6.0.28, the webRTCDirect() Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, and protocol negotiation. The packet-controlled request.ufrag is forwarded to DirectRTCPeerConnection.setLocalDescription and reused as an ICE password without validating its required length and character set, causing an uncaught native invalid_argument and process abort with SIGABRT.