CVE Vulnerability Catalog

A vulnerability in insights-runtime-extractor allows an unprivileged tenant to take over a node. The scanning process does not sufficiently drop privileges (only seteuid, without changing ruid/suid and without removing capabilities), and then executes a workload-controlled binary with root privileges in the host namespace. An attacker can exploit this to gain full node access through the CRI-O socket.

A vulnerability in JTL-Shop's authentication middleware processes the plugin safe mode toggle on the admin logout route before checking authentication. An unauthenticated attacker can toggle the safe mode, deactivating all plugins and causing a shop-wide denial of service.

The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration backend, allowing script code injection that executes in an administrator's browser session.

A Code Injection vulnerability in VillaTheme Email Template Customizer for WooCommerce allows code injection. Affects versions up to 1.3.4.

The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret that is empty on a store which has not entered its credentials. This allows unauthenticated attackers to mark arbitrary orders as paid and to disclose the name, email address and postal address of any order's customer.

A vulnerability in NSD involves text tokens in RDATA (e.g., TXT records) under 32 bytes not being checked to stay within the reserved space, allowing arbitrary sized out-of-bounds stack writes, including overwriting a callback function pointer.

A vulnerability in NSD involves a HIP resource record that fills RDATA near its limit and has another dname RDATA field (a HIP Rendezvous server), which can overwrite the stack with up to 191 bytes of attacker-controlled data.

A vulnerability in NSD involves SVCB or HTTPS RRs that fill the wire format RDATA to the brim, where another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker-controlled data of unlimited size.

A vulnerability in NSD involves base64 data split into pieces of 3 characters or less, where tokens are incorrectly calculated to produce 0 bytes, enabling attackers to overwrite the stack with up to 64K of attacker-controlled data.

The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode. This allows unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests.

A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers). An out-of-bounds write vulnerability exists in the DCI parsing function, where a reserved field value is incorrectly accepted, causing the parser to write beyond the bounds of an internal structure. An attacker could exploit this by providing a specially crafted H.266 bitstream to a third-party application that uses this library API, potentially causing a crash or memory corruption. No standard GStreamer pipeline element currently invokes the affected code path.

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can cause a file to be written outside the intended extraction directory.

A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy forwards requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. A pipelined second request is relayed verbatim to the backend, bypassing the configured path restrictions.

A heap buffer overflow was found in gst-plugins-base. It can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets exceeding the actual backing memory allocation. The metadata is not range-checked during deserialization, and the frame mapping code does not verify that the declared plane geometry fits within the buffer.

HPE NonStop MODULAR NSJ contains a predictable seed vulnerability in Random Number Generation (PRNG).

HPE NonStop Middleware software has a secret key handling and data deserialization vulnerability. Technical details were not provided in the description.

A security vulnerability in HPE NonStop Java JToolkit can allow command injection and buffer overflow.

A security vulnerability in HPE NonStop Hpjmeter can cause stack and heap buffer overflow.

A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem.

A flaw in the clevis PKCS#11 pin: the clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without restrictive permissions. Under the default umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the decryption script exits early, leaving the PIN accessible indefinitely.