CVE Vulnerability Catalog

The UMP Stream responder library in Zephyr (lib/midi2/ump_stream_responder.c) contains an information leak vulnerability. The make_endpoint_info() and make_function_block_info() functions do not initialize the entire response structure, leaving the last two words (8 bytes) with stale stack data. The vulnerability is triggered by sending discovery requests (Endpoint-Discovery or Function-Block-Discovery) over the network (Network MIDI 2.0) or USB MIDI 2.0, causing the device to send this data to the attacker.

Vulnerability in the userspace syscall verifier z_vrfy_mbox_send() in the mbox driver allows unprivileged threads to bypass access controls and read kernel memory or cause a denial of service via a time-of-check/time-of-use race.

XSS vulnerability in Horde IMP's AppleDouble MIME viewer allows an attacker to execute script in the context of a user viewing the message, due to improper escaping of the attachment name in an HTML status block.

Improper authorization vulnerability in TIM Flow before 26.0.6 allows any authenticated user to submit arbitrary SQL queries to a privileged dashboard Excel export endpoint intended for administrative use only.

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service.

Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlled input before it is incorporated into Redis SCAN MATCH patterns. An unauthenticated attacker could supply Redis glob metacharacters such as *, ?, [ or ] to broaden the SCAN operation beyond the intended group, potentially exposing health information, mirror slugs, and uptime series belonging to all groups and markets, including private entities. Similar unsafe interpolation was present in /api/crypto/chain/<chain> and in the delete_manual_torrent() function, where it could lead to deletion of torrent-health keys belonging to other torrents.

A vulnerability was identified in bytebot-ai bytebot 0.0.1. The affected element is an unknown function of the component Agent Execution Workflow. Such manipulation leads to infinite loop. The attack may be performed from remote. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with fs.openSync(path, "w", 0o666), which resolves symbolic links and carries neither O_NOFOLLOW nor a pre-write fs.lstatSync check. When a path component at the destination already exists as a symbolic link pointing outside the extraction root, extractAllTo, extractAllToAsync and extractEntryTo write the entry contents through that link and then chmod its target, placing attacker-controlled content in a file outside the root without any traversal sequence appearing in the archive. Reaching the write requires overwrite to be enabled, because the preceding fs.existsSync check also resolves the link and otherwise declines.

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. Grafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user's permissions.

HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access to resources.

HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly. Although no sensitive information (e.g., credentials, PII) was discovered, exposing API documentation to unauthenticated users can increase the overall attack surface.

A flaw was found in JSS (Java Security Services). The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without TRUSTED_CA flags to be accepted as trust anchors for TLS connections. In non-default configurations where certificate revocation checking is disabled, this could allow a man-in-the-middle attacker to forge certificates accepted by PKI client connections.

Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.

Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.

Unauthenticated CSRF vulnerability in Hash Form versions up to 1.4.0. An attacker can exploit this to perform unauthorized actions in the context of a logged-in administrator.

Unauthenticated CSRF vulnerability in Fluent Support Pro versions up to 2.3.1. An attacker can exploit this to perform unauthorized actions in the context of a logged-in user.

IDOR vulnerability in Fluent Boards Pro versions up to 2.0.11, affecting subscriber role users. Allows access to unauthorized objects.

SSRF vulnerability in FluentCRM Pro versions up to 3.1.12, affecting subscriber role users. Allows sending requests from the server to internal resources.

Broken Access Control vulnerability in Fluent Support Pro versions up to 2.3.1, affecting subscriber role users. Allows unauthorized access to functions or data.

SSRF vulnerability in Shared Files versions up to 1.7.69, affecting contributor role users. Allows sending requests from the server to internal resources.