CVE Vulnerability Catalog

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism.

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression.

A vulnerability was determined in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/ajax.php?action=save_settings. This manipulation of the argument Name causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied workflow_run_backend_id and never check that it belongs to the requester: validateRunIDV4 in pkg/artifacts/artifacts_v4.go parses the value and returns it with the comparison against the requesting task's run ID left commented out.

zlib versions 1.2.11 through 1.3.2 contain a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.

Official Flair wheels for versions 0.15.0 and 0.15.1 still contain flair/models/clustering.py, which executes arbitrary Python code when loading a model. The previous fix for CVE-2024-10073 does not remove this issue from the distributed package.

Mercado Pago Node.js SDK does not encode identifiers in API paths, allowing request manipulation. An attacker can redirect requests to a different endpoint or append query parameters, using the merchant's access token.

Xinference enables remote code execution by default when loading Hugging Face models, and before version 2.12.0 there is no setting to disable it. An attacker with model launch access can execute arbitrary code.

Multiple vulnerabilities in Zscaler Client Connector allow local privilege escalation, giving an unprivileged user the ability to execute arbitrary code in a privileged context.

A locally exploitable buffer overflow bug can cause a local denial-of-service attack on Zscaler Client Connector on Android and ChromeOS.

A remotely exploitable buffer overflow bug can cause a local and kernel denial-of-service attack on Zscaler Client Connector on Windows.

A local privilege escalation vulnerability exists in the Restricted Access (Kiosk) Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5. The vulnerability affects the external PDF viewer used to display the application manual and its interaction with Windows. An authenticated low-privileged user can escape the kiosk environment by abusing the print functionality, allowing arbitrary command execution with local administrator privileges.

HCL Hive is affected by a cryptographic primitive with a risky implementation which could allow an attacker unauthorized lateral compromise or widespread credential leakage if a single internal component is breached.

SQL injection vulnerability in SourceCodester Simple Online Food Ordering System 1.0 in the file /fos/admin/ajax.php?action=confirm_order. Manipulation of the argument ID allows remote attack. The exploit has been made public.

HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environments.

SQL injection vulnerability in FluentCRM Pro versions up to 3.1.12. An attacker can exploit it to manipulate database queries.

SQL injection vulnerability in Online Clinic Management System 1.0, in success/login.php, in the Admin Login component. Manipulation of the Username argument leads to SQL injection. Remote exploitation is possible.

Firmware in KAON PG5298A and PG5298B routers allows an unauthenticated user to query a specific endpoint and acquire sensitive information such as the admin portal password. Fixed in firmware versions 3.0.82 (PG5298A) and 4.0.82 (PG5298B).

Unauthenticated Local File Inclusion in Verdure Core versions up to 1.2. Allows reading sensitive files from the server.