CVE Vulnerability Catalog

An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths deserialize stored values without restricting which PHP classes may be instantiated instead of using Mautic's safe deserialization helper; an attacker able to store a crafted serialized value can cause arbitrary PHP objects to be instantiated, and combined with gadget chains in Mautic's dependencies could execute arbitrary code on the server and read, modify, or delete data.

A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates (the fix for GHSA-9fx4-7cmj-47vg) does not fully enforce its restrictions, allowing a crafted theme template to escape the sandbox; an authenticated user with core:themes:create permission can upload a malicious theme whose template is later rendered, resulting in arbitrary code execution with the privileges of the web server process.

A vulnerability in the Bandit (Elixir) library allows an unauthenticated remote attacker to exhaust server memory via a fragmented WebSocket message made of many 1-byte continuation frames. The fragment reassembly does not limit the number of fragments, so memory usage can greatly exceed the configured limit.

An inefficient algorithmic complexity vulnerability in Bandit's HTTP header integer parser allows an unauthenticated remote attacker to consume server CPU by sending a Content-Length value or Host/:authority port made of thousands of digits. The parser builds the number digit by digit without a length limit, resulting in quadratic time complexity.

An improper cleanup on thrown exception vulnerability in Bandit's HTTP/2 handler allows an unauthenticated remote attacker to bypass per-connection resource limits by sending multiple frames in a single TCP write, one of which raises a stream error. The connection state rolls back, causing streams to be forgotten and limits to be exceeded.

An allocation of resources without limits or throttling vulnerability in Bandit's HTTP/1.1 chunked body reader allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks. The reader keeps every chunk as a separate term without limiting the number of chunks.

An allocation of resources without limits or throttling vulnerability in Bandit's HTTP/2 implementation allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGS_HEADER_TABLE_SIZE. The HPACK encoder table is resized to the client-advertised size without a server-side cap, causing O(N²) CPU cost for N responses.

A vulnerability in the CreditNirvana Agentic AI Call Centre application due to a hardcoded static API key in the client-side JavaScript bundle. An unauthenticated remote attacker can download the JavaScript files, extract the API key, and make arbitrary API calls to retrieve call transcripts and recordings.

An improper handling of highly compressed data (data amplification) vulnerability in Bandit's HTTP/2 implementation allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores a large cookie value in the HPACK dynamic table and references it many times, causing excessive memory allocation.

An inefficient algorithmic complexity vulnerability in Bandit's HTTP/2 implementation allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The server walks the entire queue of blocked sends for each frame, resulting in O(n²) list operations for n blocked streams.

An allocation of resources without limits or throttling vulnerability in Bandit's HTTP/2 implementation allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker blocks the stream process and floods it with small DATA frames, which are queued until the BEAM node runs out of memory.

Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation. This issue affects Liman MYS from 2.3.4-1124 before 2.3.5-1131.

A weakness has been identified in libimobiledevice up to 1.4.0 affecting the service_receive function of src/afc.c in the AFC Service component. Manipulation can lead to a double free, the attack may be performed remotely, and the exploit is publicly available.

Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write access control and performs an unprotected requests.get call that follows redirects without re-validating resolved IP addresses. A low-privilege authenticated user can supply an image_url pointing to an internal address or use DNS rebinding and open redirects to make the server fetch internal resources or cloud metadata endpoints, with successful image responses saved to a world-readable /files/ URL.

MISP Guard, a proxy-based security filter for MISP feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_blocked_attribute_categories, and check_blocked_analyst_data_sharing_groups_uuids performed case-sensitive string comparisons when matching event tags, attribute categories, and sharing-group UUIDs against configured allow/block lists.

In BillaBear up to 2025.01.03, the processInstall function in src/BillaBear/Controller/InstallController.php (Installation Handler component) lacks authentication. A remote attacker can exploit this, and a public exploit is already available. The vendor did not respond to the disclosure.

In geesondog RhaPHP (up to commit 7ae639ccf8dcb627faace096d030bd4cb4cfb905), the image function in application/mp/controller/Show.php (Mp Module Media Proxy component) allows manipulation of the url argument, resulting in server-side request forgery. The attack can be launched remotely, and a public exploit is available. The vendor did not respond to the disclosure.

The WordPress Media Library Assistant plugin in versions up to 3.42 contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This may allow an attacker to perform blind SQL injection.

The Crocoblock JetEngine WordPress plugin in versions up to 3.9.0 contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This may allow an attacker to inject malicious SQL code.

A vulnerability was found in DedeCMS 5.7.118 affecting the common.inc.php::_RunMagicQuotes function in plus/ad_js.php of the Advertisement Rendering component. Manipulating the aid argument can lead to code injection, and the attack can be executed remotely.