CVE Vulnerability Catalog

The Joomla extension iCagenda before version 2.0.0-4.0.11 contains an ACL bypass vulnerability allowing arbitrary user enumeration. A backend operator with access only to com_icagenda could enumerate Joomla user profiles.

The Joomla extension iCagenda before version 2.0.0-4.0.11 contains a CSRF vulnerability in frontend registration actions. Multiple state-changing operations in the frontend are callable without a CSRF token check.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to delete arbitrary files due to path traversal.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper neutralization of special elements used in an SQL command.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of file paths.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to the ability to disable server-side input validation via a request parameter.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication.

js-toml, a TOML parser for JavaScript, before version 1.1.2 contains a vulnerability due to incorrect duplicate key checking. Instead of checking `if (key in object)`, it uses `if (object[key])`, causing that when the previous value is falsy (e.g., `false`, `0`, `""`), the duplicate key branch is skipped and the value is silently overwritten. This leads to structural type confusion in the returned object.

LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database (CPDB) workflow that copies survey participant tokens to the central participant list.

Missing CSRF protection in the execute_tool action in admin/ai.php in Emlog 2.6.26 and earlier allows a remote unauthenticated attacker to submit a forged request to a logged-in administrator. The attack can read all database tables and write to all tables except blog, including taking over an administrator account.

In Capstone before version 6.0.0-Alpha9, the public cs_insn_name() API forwards instruction IDs to M68K and RISCV backends without proper bounds checks, potentially causing an out-of-bounds read and process crash.

An improper access control vulnerability allows an authenticated non-administrative user to view settings outside their assigned scope.

CSRF tokens were generated using a predictable method, reducing their effectiveness. This has been addressed by improving randomness and entropy of token generation.

A SQL injection vulnerability in Security Center allows an authenticated administrator to execute arbitrary SQL queries, potentially leading to unauthorized access to sensitive data, including credentials.

A use-after-free vulnerability exists in the Zephyr second-generation work queue (kernel/work.c) in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler work_timeout() is in flight (blocked acquiring the work-queue spinlock), a concurrent cancellation does not wait for that handler to finish. This allows k_work_cancel_delayable_sync() and k_work_flush_delayable() to return without blocking, and freeing the object leads to a use-after-free read and write.

The LoRaWAN Fragmented Data Block Transport service (frag_transport.c) does not validate the fragment counter in a received DATA_FRAGMENT command before forwarding it to the decoder. A frag_counter of 0 causes an underflow (frag_counter - 1), leading to an out-of-bounds write (CWE-787) in the default Semtech/LoRaMAC-node decoder, corrupting decoder state and disrupting the firmware-update (FUOTA) session.

CKAN MCP Server before 0.4.112 contains a vulnerability in canonicalizeParams in src/utils/cache.ts that serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide. An attacker can prime a shared cache with a response for a victim's distinct query.

CKAN MCP Server before 0.4.112 contains a vulnerability in the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools in src/tools/quality.ts. The isValidMqaServer function validates the server_url parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host and URL-userinfo values to target an attacker-controlled host and return a spoofed response.

crun before version 1.28 contains a vulnerability in the default device setup that opens the container rootfs `/dev` directory without `O_NOFOLLOW`. If an OCI bundle contains `rootfs/dev` as a symlink and the bundle configuration does not mount `/dev`, crun follows that symlink and creates default device nodes and stdio symlinks at the symlink target outside the container rootfs. This can lead to overwriting existing files, such as ptmx.