CVE Vulnerability Catalog

The league/commonmark library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension. When either extension is explicitly registered on the Environment (they are not enabled by default and are excluded from the standard CommonMark and GitHub-Flavored Markdown converters), an unauthenticated attacker can submit small, specially crafted Markdown documents — such as text alternating with unpaired quotes, contiguous runs of block-level attribute blocks, or repeated class attributes — to trigger disproportionate CPU consumption and cause a denial of service.

Denial of service vulnerability in commonmark versions from 1.5.0 before 2.10.0 in the AttributesExtension when processing distinctly-named attributes. Attackers can submit Markdown with numerous distinct attribute names to cause quadratic-time attribute merging and filtering, consuming disproportionate CPU resources and preventing legitimate requests from completing.

LibreNMS before 26.8.0 contains an argument injection vulnerability in the graph_title parameter that allows authenticated attackers to inject arbitrary rrdtool arguments by breaking out of double-quote escaping. Attackers can inject DEF and LINE arguments to read RRD files from unauthorized devices, or use newline injection to execute arbitrary rrdtool commands, bypassing per-device authorization checks.

A weakness has been identified in light0011 cms in the file App/Home/Model/UserModel.class.php of the Cookie Helper component. Manipulation of the Username argument leads to improper authentication. The attack can be performed remotely, and the exploit is publicly available.

A security flaw has been discovered in light0011 cms in the function Upload::upload of the file ThinkPHP/Library/Think/Upload.class.php. Manipulation results in unrestricted upload. The attack can be carried out remotely, and the exploit is publicly available.

A vulnerability was determined in 92181 markdown up to version 058cab0cb7fb245a0ccc6b8446963ff8d573558f. The function lds in file md.c is affected. Manipulation can lead to out-of-bounds read. The attack can be executed remotely. A patch is available as c000d2f9cf390c315378d3717cf20911cf3e80a6.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Check or Handling of Exceptional Conditions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Relative Path Traversal vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.

The User Profile Builder plugin for WordPress up to version 3.15.7 is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.

Dell Secure Connect Gateway (SCG) 5.0 Application, versions prior to 5.36.00.00, contains an OS Command Injection vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.

PocketMine-MP before versions 3.26.5 and 4.0.5 fails to validate the length of skin data fields submitted by players, allowing values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized fields like skinID or geometryName to trigger exceptions during NBT serialization, causing server crashes.

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via checkSecurity()/isTrustedType(). However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes, meaning all classes are deserializable by default.

A flaw has been found in Tenda AC9 15.03.05.14. This impacts the function R7WebsSecurityHandler of the component Web Management. This manipulation causes improper authentication. The attack may be initiated remotely. The exploit has been published and may be used.

A vulnerability was discovered in SourceCodester Class and Exam Timetabling System 1.0 in an unknown function of the file /delete_subject.php. Manipulation of the argument ID results in SQL injection. The attack can be initiated remotely and the exploit has been publicly released.

A vulnerability was identified in D-Link DIR-605 B1v202WWB03 in the tunnel_set_params function of the file progs.gpl/pppd.alpha/l2tp/tunnel.c in the L2TP Control Message Parser component. Manipulation of the argument peer_hostname leads to an off-by-one error. The attack may be performed remotely but is highly complex and difficult to exploit. The exploit is publicly available.

A vulnerability was found in D-Link DIR-895L A1_102b07 in the sendACK function of the file udhcpcd/serverpacket.c in the udhcpcd component. Manipulation of the argument Hostname results in command injection. The attack can be executed remotely and the exploit has been made public.

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.