CVE Vulnerability Catalog

rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially crafted checksum set containing a zero-length block to cause a negative offset calculation during delta computation, resulting in an out-of-bounds read of file data buffer memory on the sender side.

rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree. Attackers can exploit multiple variants to cause the receiver to delete files outside the authorized destination directory.

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters to corrupt uid/gid mapping logic.

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.

@jshookmcp/jshook is an MCP server that gives AI agents tools for JavaScript analysis and security research. In version 0.3.1, the network domain has a central SSRF authorization policy that blocks private, loopback, link-local, and reserved targets unless an explicit authorization object allows private network access. The policy is enforced by raw HTTP/TCP/TLS RTT tools, but the ICMP probe and traceroute tools resolve the target and invoke the native ICMP/traceroute sink directly. An MCP client with access to an active network domain can therefore ask the jshookmcp server to probe internal addresses even when local SSRF access is disabled for the other raw network tools. This exposes an internal reachability and route mapping primitive from the server network position. Version 0.3.2 fixes the issue.

In Probo, the `saferedirect` package improperly validated redirect URLs by only inspecting the second character of relative paths. A URL like `/../\evil.com` passed validation, and browsers could interpret the backslash as a host separator, redirecting users to an external domain. This enables open-redirect phishing attacks.

ELAN reported a potential out-of-bounds write vulnerability in the ELAN TrackPoint driver that, under certain circumstances, could allow a local authenticated user to cause a system crash.

Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions.

Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.

Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions.

Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions.

Unauthenticated Broken Access Control vulnerability in GiveWP plugin versions prior to 4.16.6.

Author-level Cross Site Scripting (XSS) vulnerability in WP Data Access plugin versions up to and including 5.5.79.

Contributor-level Cross Site Scripting (XSS) vulnerability in Featured Image from URL plugin versions up to and including 5.3.3.

In basecamp/upright at a specific commit, Rails CSRF protection is disabled for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management endpoints, such as creating an Alertmanager silence or requesting a Prometheus reload. The final impact depends on the APIs enabled by the upstream services.

Subscriber-level Broken Access Control vulnerability in Motors plugin versions up to and including 1.4.113.

Unauthenticated Broken Access Control vulnerability in Anti Spam and list cleaner – AcyChecker plugin versions up to and including 2.0.0.

Customer-level Cross Site Scripting (XSS) vulnerability in WpBookingly plugin versions up to and including 1.3.2.

Unauthenticated Broken Access Control vulnerability in Contact Form 7 – PayPal & Stripe Add-on plugin versions up to and including 2.5.1.

Subscriber-level Server Side Request Forgery (SSRF) vulnerability in Vehica Core plugin versions up to and including 1.0.104.