CVE Vulnerability Catalog

Null pointer dereference in the AddTime API causes authenticated denial of service.

Blind SSRF vulnerability in OAuth2 avatar synchronization via unvalidated OIDC picture claim.

In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Collaboration (ZCS) due to insufficient validation of request content types. An attacker can exploit this vulnerability by causing an authenticated user to submit a crafted request, potentially allowing unauthorized actions to be performed on behalf of the victim.

In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request parameter. An unauthenticated attacker can exploit this vulnerability by supplying a crafted path, potentially allowing unauthorized disclosure of protected files, such as WEB-INF/web.xml, within the web application directory. This occurs in the Forward servlet.

In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the packages parameter. An authenticated attacker can exploit this vulnerability by supplying a crafted path traversal sequence, potentially allowing unauthorized disclosure of sensitive files within the web application directory.

An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending functionality. An authenticated attacker can send specially crafted SOAP requests to impersonate another user and send emails without possessing the required delegation or send-as permissions. This occurs in the SaveDraftRequest SOAP handler.

HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page (JavaScript hijacking) under certain conditions.

HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted by the application, potentially resulting in unintended behavior or security impact under certain conditions.

In PostgreSQL, the ALTER TABLE ALTER TYPE command incorrectly reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table owner to run DROP STATISTICS and ALTER STATISTICS, while denying those commands to the prior owner. In many ownership arrangements, DROP TABLE still removes statistics objects, so the exploit often achieves nothing.

Integer underflow in PostgreSQL ECPG allows a database server administrator to cause temporary denial of service against the ECPG client by sending a bytea value lacking the mandatory prefix. The client overwrites a large memory region with bytes outside attacker control, typically causing SIGSEGV, but rare cases might achieve client-specific integrity impact.

Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, by setting a hostile search path before calling the amcheck function. Affected versions include 18, 16, 15, and 14 before specific minor versions; PostgreSQL 17 is unaffected.

The Booking for Appointments and Events Calendar WordPress plugin before version 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data.

Version 2.0.0 of the sigstore-java library erroneously removed verification of the integrated (Rekor entry) time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements adhering to the Sigstore verification spec. The vulnerability affects only users verifying bundles with dev.sigstore:sigstore-java:2.0.0.

Loofah from 2.25.0 until 2.25.2 does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references such as &#58, &#9, &#10, or &#13. CGI.unescapeHTML leaves these references encoded, so allowed_uri? reports the URL safe even though a browser decodes an encoded colon or strips encoded whitespace and executes the resulting URI scheme. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.

Loofah from 2.25.0 until 2.25.2 does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character references 	 or 
. CGI.unescapeHTML leaves those references intact, so allowed_uri? reports the URL safe even though a browser decodes and strips the tab or line feed and executes the resulting javascript: URL. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.

Trix prior to 2.1.18 is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without Input Events Level 2 support. The StringPiece.fromJSON method trusts href attributes from the JSON payload without sanitization, allowing a draggable element containing a javascript: URI to bypass DOMPurify sanitization and inject executable JavaScript into the DOM. Exploitation requires the victim to drag and drop attacker-controlled content, and server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.

Astro prior to 8.1.2, the Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remote_images for Netlify's Image CDN allowlist. In packages/integrations/netlify/src/index.ts, remotePatternToRegex() escapes dots in hostname values but interpolates literal pathname values without escaping regular expression metacharacters such as ., +, ?, (, and [, so a restrictive pathname such as /img/v1.0/file also matches metacharacter-adjacent paths, including paths that cross a segment. Netlify enforces the generated regular expression directly and Astro's matchPattern() helper does not revalidate the request, allowing optimization of images on an already-allowed host that the declared pathname was intended to exclude. This issue is fixed in version 8.1.2.

IBM Db2 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to cause a denial of service due to a memory leak.

IBM Security Verify Access and IBM Verify Identity Access (including container versions) in certain Reverse Proxy configurations are vulnerable to a denial of service attack.

GitLab EE has a vulnerability in versions 15.6 through 19.0.6, 19.1 through 19.1.4, and 19.2 through 19.2.2 that under certain conditions could allow a user with pending membership to receive permissions granted by a custom role due to incorrect privilege assignment that did not account for membership state.