CVE Vulnerability Catalog

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Buffer#clear in ext/msgpack/buffer.c leaves rmem_last, rmem_end, and rmem_owner stale after _msgpack_buffer_shift_chunk returns an rmem page to the shared pool, allowing a subsequent Buffer#write and a second MessagePack::Buffer to alias the page and disclose or corrupt cross-buffer data. This issue is fixed in version 1.8.2.

CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak encryption vulnerability that allows unauthenticated attackers to recover all stored secrets in plaintext by reversing a single-byte XOR cipher with a static key. Attackers can trivially decrypt the Router.cfg backup file to expose web administration and telnet passwords, WPA/WPA2 pre-shared keys, PPPoE and 3G/APN credentials, and SIM identifiers including IMSI and IMEI.

In Samba's Kerberos KDC password change (kpasswd) service, an out-of-bounds read flaw exists. When processing malformed ASN.1-encoded requests, the server miscalculates structure size and attempts to read up to six bytes beyond the allocated buffer, potentially causing the KDC process to crash and resulting in denial of service.

An XSS vulnerability in Apache JSPWiki allows an attacker to inject malicious JavaScript via a crafted editing request, exploiting parsing errors in the Markdown renderer. This could lead to session hijacking and theft of sensitive data.

Apache Zeppelin versions 0.11.1, 0.11.2, and 0.12.0 are vulnerable to LDAP filter injection. LdapRealm uses incorrect escaping (RFC 4514 instead of RFC 4515), leaving filter characters insufficiently escaped. This is an incomplete fix of CVE-2024-31867.

Apache Zeppelin versions 0.6.0 through 0.12.0 are vulnerable to LDAP injection. ActiveDirectoryGroupRealm constructs LDAP filters without escaping user input, allowing an authenticated attacker to inject filter syntax via the user-search endpoint.

Apache Zeppelin versions 0.6.0 through 0.12.0 are vulnerable to Cross-Site Request Forgery (CSRF). The default CORS configuration allows cross-origin state-changing requests and accepts text/plain bodies, enabling an attacker to perform actions on behalf of an authenticated user.

A ReDoS vulnerability in Apache Superset, located in the sql_parse.py component, allows an authenticated attacker to cause significant server load by sending a crafted SQL query with a long string of characters. This can lead to denial of service.

An improper authorization vulnerability in Apache Superset allows an authenticated user with chart update permissions to modify dashboards they do not own. This occurs because the validation in UpdateChartCommand does not check write permissions for target dashboards.

A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body.

A vulnerability in Vendure (up to version 3.7.1) allows channel-scoped administrators to modify other tenants' data by bypassing channel isolation validation. The attack involves supplying global IDs of StockLocation or Asset entities from different channels.

An SSRF vulnerability in the Boruta library (versions 2.3.2 through 2.3.7) allows an unauthenticated attacker to force the OAuth/OpenID authorization server to send HTTP requests to arbitrary URIs, including internal services and cloud metadata endpoints. The vulnerability exists in three code paths that do not properly validate target URIs.

A vulnerability in Calico allows a user with the deletecollection verb or wildcard on tier-scoped policy resources to bulk-delete policies in tiers they have no rights on. This occurs because the Delete method for NetworkPolicy, GlobalNetworkPolicy, and their variants is not invoked for DeleteCollection requests, bypassing AuthorizeTierOperation authorization.

An XSS vulnerability in IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server allows an attacker to inject malicious JavaScript in the Administrative Console. This could lead to credential theft or other sensitive information disclosure.

An XSS vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway (versions 6.2.2.0 through 6.2.2.0_1) allows an authenticated user to embed arbitrary JavaScript code in the Web UI. This could lead to credential disclosure within a trusted session.

An XSS vulnerability in the Ebics server component of IBM Sterling B2B Integrator and IBM Sterling File Gateway (multiple versions) allows an authenticated user to embed arbitrary JavaScript code in the Web UI. This could lead to credential disclosure within a trusted session.

A flaw in Samba's internal DNS server allows unauthenticated TKEY registration requests to be added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can send a large number of TKEY requests with arbitrary names, exhausting the cache and evicting legitimate TKEY entries.

CentreStack before version 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embedding newline and tab characters into a crafted AccountName parameter posted to the SelectProvider.aspx endpoint. Attackers can exploit the lack of input sanitization in the custom session serialization format to inject a resellerid session variable, bypassing the IsValidRSession authentication check and gaining unauthorized access to management pages.

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process. This affects PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on the toggle_sync_status() function. This makes it possible for unauthenticated attackers to toggle the status of sync rules (enable/disable) via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.