CVE Vulnerability Catalog

iccDEV before version 2.3.2.1 has a size_t underflow vulnerability in the `CIccEmbedIO::Read8()` function. The issue occurs when parsing ICC profiles containing `icSigEmbeddedV5ProfileTag` data with `icSigEmbeddedProfileType` payloads, potentially leading to incorrect behavior.

Incus before version 7.1.0 has a nil-pointer dereference vulnerability in `(*backend).CreateInstanceFromBackup`. An authenticated user with permission to create instances can remotely trigger a crash of the Incus daemon by uploading a crafted backup tarball, causing denial of service to all projects on that cluster member.

The PassPortal browser extension by N-able before version 3.49.6 has a vulnerability allowing vault token disclosure via unvalidated postMessage, enabling authentication abuse.

Roskus Prospero Flow CRM versions 4.9.1 through 5.14.0 have an authorization bypass vulnerability via user-controlled key in the transaction save endpoint. A user with transaction creation permissions can disclose another company's bank account name, bank name, and card last four digits by providing a foreign `bank_account_id` or `bank_card_id` in POST /transaction/save.

The Joomla extension Zoo (from yootheme.com) before version 4.1.66 has a reflected XSS and open redirect vulnerability via the submission redirect parameter.

The Joomla extension Zoo (from yootheme.com) before version 4.1.66 has an unauthenticated arbitrary directory listing vulnerability via the Gallery element.

The Joomla extension Zoo (from yootheme.com) before version 4.1.66 has missing CSRF tokens on front-end state changes, enabling CSRF attacks.

Spring AI versions 2.0.0, 1.1.0-1.1.8, and 1.0.0-1.0.9 have a vulnerability in tool calling support where the per-request tool list is not fully enforced. Under certain conditions, a tool not made available to the current request could be invoked, potentially leading to privilege escalation.

In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be shared across unrelated contexts. Affected versions: Spring AI 2.0.0.

The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes that are then executed when the page is viewed, disclosing a chosen user's email address, login and registration date.

The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an unauthenticated attacker to read the content of globally password-protected posts and pages.

The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment.

The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a payment for the expected amount to a gateway account they control rather than the site's.

The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link (CSRF).

The report.list procedure in Reconmap's trpc package accepted a projectId and a dashboardId, but only verified membership for the supplied projectId, not that the dashboardId belonged to that project. An authenticated user could pair a projectId from their own organization with a dashboardId from another organization and receive every report in that dashboard. A correctly scoped helper, listReportsCore, already existed but was not used by the router.

The report.get procedure in the TRPC router accepts only a reportId and returns getReportById(reportId) without access checks. The enforceAccess middleware only evaluates membership when the input carries a projectId or organizationId key, so a reportId alone passes through unchecked. An authenticated user can read the full configuration of any saved report, including projectId, event series, filters, breakdowns, and formulas.

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derives every operation's target from path(key) without checking that the result stays within the root. Object keys from an external store can contain traversal segments, allowing writes outside the intended local directory with no error. An operator syncing from a not fully controlled bucket is exposed to file writes at attacker-influenced locations.

A vulnerability in the misp-stix library stems from incomplete clearing of parser state between STIX document conversions. Reusing the same parser instance can cause data from a previously processed document (e.g., galaxies, DNS records, titles, timestamps) to be incorporated into the MISP event generated from a subsequent document. The issue affects both STIX 1 and STIX 2 parsers.

A weakness has been identified in Dolibarr up to 23.0.4 in the file htdocs/user/card.php of the Account Handler component. Manipulation of the ID argument causes improper authorization. The attack can be initiated remotely, and the exploit is publicly available. Upgrading to version 24.0.0 mitigates the issue.

Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. The vulnerability affects Micrometer versions 1.17.0, 1.16.0-1.16.6, 1.15.0-1.15.12, 1.14.0-1.14.16, and 1.9.18 and earlier.