CVE Vulnerability Catalog

A vulnerability was detected in sdcb chats up to version 1.12.0. It affects the McpController function in the file src/BE/web/Controllers/Users/Mcps/McpController.cs of the fetch-tools Endpoint component. The manipulation results in server-side request forgery. The attack can be launched remotely, and the exploit is public.

A weakness has been identified in caoqianming django-vue-admin 1.0. The vulnerability affects unknown code in the file /api/file/. Manipulating the file_id argument leads to improper access controls. The attack can be executed remotely, and the exploit is publicly available.

A security flaw has been discovered in Doccano Open Source Annotation Tools up to version 1.8.5. It affects the LabelList function in the file /v1/projects/1/category-types of the Bulk-Delete Endpoint component. Performing a manipulation results in improper access controls. Remote exploitation is possible, and the exploit is public.

A vulnerability was identified in Doccano Open Source Annotation Tools up to version 1.8.5. It affects the ExampleDetail function in the file /v1/projects/1/examples/ of the Project Example Detail Endpoint component. Such manipulation leads to improper access controls. The attack may be launched remotely, and the exploit is publicly available.

A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0.

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module::settingsForm allows to view (not change) super admin-restricted module settings and leak the full module entity. Exploitation is possible on behalf of an authorized user who has access to the Module View feature, which are not granted to non-admins as standard. Users should upgrade to version 4.4.3 which fixes this issue. Upgrading to a fixed version is necessary to remediate. Users unable to upgrade should revoke such privileges from users they do not trust.

Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger cloud update checks via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase traceroute logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 allows unauthenticated attackers to remove Wi-Fi schedule entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

In the IPv6 subsystem of the Zephyr stack (subsys/net/ip/ipv6_nbr.c), the net_ipv6_send_ns() function allocates a transmit net_pkt for a Neighbor Solicitation. When called with a data packet pending on an unresolved neighbor and the neighbor's pending_queue is already non-empty, the function appends the data packet and returns early without sending the NS via net_send_data() or releasing it with net_pkt_unref(). The freshly allocated NS net_pkt and its attached TX buffers are held only by a local variable and are leaked permanently, never returning to CONFIG_NET_PKT_TX_COUNT / CONFIG_NET_BUF_TX_COUNT.

A vulnerability was found in FLVMeta up to 1.2.2 in the function amf_object_get in src/amf.c during AMF object parsing. The manipulation causes a null pointer dereference. The attack can be initiated remotely, and the exploit has been publicly disclosed.

A vulnerability was found in FLVMeta up to 1.2.2 in the function amf_string_new in src/amf.c during AMF string processing. Manipulation of the length argument results in a heap-based buffer overflow. The attack can be launched remotely, and the exploit has been made public.

A vulnerability was found in dibo-software diboot 3.8.0 in an unknown part of the file /api/iam/tenant/resource in the Tenant Resource Assignment Handler component. Manipulation of the tenantId argument leads to improper access controls. The attack can be launched remotely, and the exploit has been publicly disclosed.

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through 1.18.0, oasdiff did not enforce --allow-external-refs=false (library: openapi3.Loader.IsExternalRefsAllowed = false) when loading a spec from a git revision (the rev:path form, e.g. main:openapi.yaml). External $refs were resolved on that load path even when external refs were explicitly disabled, so the mitigation silently did not apply there.

A vulnerability in Zephyr RTOS causes network buffer (net_pkt) leaks when Ethernet bridging is enabled (CONFIG_NET_ETHERNET_BRIDGE). Frames with unrecognized EtherType that are also delivered to the local stack are marked as NET_OK, which is interpreted as consumed, but they are never freed. An attacker on the L2 segment can flood broadcast/multicast frames with arbitrary EtherType, exhausting the RX buffer pool and causing a persistent denial of service until reboot.

The LwM2M JSON content formatter's get_string() function has an out-of-bounds write vulnerability (CWE-787). The length check uses 'string_length > buflen', which accepts a string whose length exactly equals the buffer size, then writes a NUL byte one past the end after memcpy. An attacker can trigger a one-byte overflow, potentially corrupting adjacent memory.

Release of an invalid pointer in the AMD kernel mode driver (KMD) could allow a privileged attacker to create a double free condition potentially leading to arbitrary code execution.

A vulnerability was found in dibo-software diboot 3.8.0 in some unknown functionality of the file /admin/ in the Tenant Administrator Management API component. Manipulation of the tenantId argument results in improper access controls. The attack may be initiated remotely, and the exploit has been made public.

A vulnerability has been found in dibo-software diboot 3.8.0 in an unknown functionality of the file /api/ai-session/ in the AI Session Endpoint component. Such manipulation leads to authorization bypass. The attack can be launched remotely, and the exploit has been disclosed to the public.

A vulnerability was detected in the TubeBuddy for YouTube Extension up to version 5.8.4 on Chrome. It affects the TBGlobal.GetToken function in tubebuddymaster1.js, where manipulation of arguments t/c/r results in insufficient verification of data authenticity. The attack can be launched remotely, and the exploit is now public.