CVE Vulnerability Catalog

SolidInvoice prior to version 3.0.1 contains a deserialization vulnerability in the DataGrid LiveComponent, where a writable context prop is deserialized with PHP's unserialize(). An authenticated attacker can supply an arbitrary PHP serialized payload, potentially leading to code execution.

PJSIP prior to commit acc03b5 has a stack buffer overflow in PJSUA when processing Service-Route headers in a registration response. An excessive number of headers can cause a write past the end of a fixed-size array on the stack.

PJSIP prior to commit 673b978 has a remote out-of-bounds read and write in the SDP negotiator when the remote payload-type map maintenance feature is enabled. Insufficient bounds validation can cause memory access outside fixed-size tables.

Frappe CRM prior to version 1.73.0 has an authentication bypass vulnerability via logged invitation keys in crm/api. An attacker can exploit these keys to gain unauthorized access.

Emlog versions 2.6.29 and prior process article content with Parsedown without enabling safe mode, allowing raw HTML including <script> tags to pass through unescaped. This results in stored XSS visible to all site visitors.

Note Mark prior to version 0.19.5 improperly validates slug values because the OpenAPI/huma pattern is not anchored, allowing paths with ../ segments to be accepted. Data export commands use these slugs to create files outside the export directory, potentially leading to file writes with root privileges.

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A null dereference causes an uncaught TypeError that terminates the process.

Parrot AR.Drone versions 1 and 2 lack a suitable mechanism to prevent denial-of-service (DoS) attacks. An attacker can harm device availability (e.g., video streaming and control) by using tools to perform IPv4 flood attacks, including SYN flooding and UDP flooding.

The Parrot AR.Drone 1 and AR.Drone 2 platform is vulnerable to Wi-Fi deauthentication attack, allowing remote and unauthenticated attackers to disconnect the drone from the controller during mid-flight.

undici 8.10.0 omits the destination origin from cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. This allows cross-origin information disclosure and persistent cache poisoning. Affects versions 8.10.0 to 8.10.2; applications using an Agent are not affected.

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application's custom checkServerIdentity was written to reject, but which still passes Node's default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool.

IBM ContextForge MCP Gateway - Translate utility <= 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session.

IBM ContextForge MCP Gateway <= v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate database transactions due to improper authorization in the DDM target dispatcher.

IBM Verify Identity Access Advanced Access Control may be vulnerable to an information disclosure attack.

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs indefinitely and can consume a service's processing capacity when an application parses attacker-controlled TOML. This issue is fixed in version 1.7.1.

In EMX Tecnologia Gestao X Business Suite version 8.4 and earlier, there is a reflected cross-site scripting (XSS) vulnerability. It is caused by insufficient validation and sanitization of the 'mensagem' parameter in the /Configuracao/Imagens.aspx endpoint, allowing an authenticated attacker to inject arbitrary JavaScript code that is reflected and executed in the context of a victim's browser.

EMX Tecnologia Gestao X version <= 8.4 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Help Chat functionality. Improper neutralization of user-controlled input during web page generation allows authenticated attackers to execute arbitrary JavaScript in the context of other authenticated users, potentially resulting in session hijacking, account takeover, and unauthorized actions.

IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.