CVE Vulnerability Catalog

In Dompdf versions 3.15 and prior, if an attacker can supply unrestricted content for rendering, they can utilize SVG rendering to leak filesystem information. Using an <image> element inside a data-URI embedded SVG, an attacker can attempt to embed other files. The difference in behavior when accessing existing vs. non-existing files enables information disclosure. This issue is fixed in version 3.16.

Dompdf versions 3.15 and earlier allow an attacker controlling HTML input to bypass restrictions by embedding a file path in an SVG image delivered via data: URI. During SVG processing, the second pass does not enforce the same protections as the first, leading to arbitrary image file reads from the server's filesystem.

Cosmos version 0.22.18 discloses Constellation device metadata to any requester supplying a non-empty Authorization header. The handler strips the 'Bearer ' prefix but never validates the token or uses it in the database query.

igloohome Smart Lock Mobile App versions 3.2.3 and earlier include sensitive information in source code, potentially allowing an unauthorized actor to access functions or backend services not sufficiently protected by authentication controls.

IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to conduct a cross-site scripting attack.

SuperPlane before 0.30.0 contains an SMTP header injection vulnerability allowing unauthenticated attackers to inject arbitrary SMTP headers by including CRLF sequences in the event payload title field delivered via webhook. Attackers can manipulate the unsanitized title field passed to the SMTP DATA command to add Bcc recipients for content exfiltration, forge the From address to bypass SPF and DKIM checks, or inject Content-Type and MIME boundary headers to corrupt message bodies for phishing.

IBM Sterling B2B Integrator and IBM Sterling File Gateway in the specified versions are vulnerable to information disclosure due to sensitive information being included in the source code comments of a dashboard component.

IBM Sterling B2B Integrator and IBM Sterling File Gateway in the specified versions are vulnerable to information disclosure due to sensitive information being included in the source code comments of a mailbox component.

IBM Sterling B2B Integrator and IBM Sterling File Gateway in the specified versions store potentially sensitive information in log files that could be read by a privileged user.

IBM TS4500 CLI tool versions 0.1.31 through 1.12.0.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man-in-the-middle techniques.

Tanium addressed a SQL injection vulnerability in Patch.

IBM Sterling B2B Integrator and IBM Sterling File Gateway in specified versions allow an authenticated user to obtain sensitive information that should only be available to a privileged user.

The SpeedyCache plugin for WordPress up to version 1.3.8 is vulnerable to Arbitrary File Read via Path Traversal. An authenticated attacker with Administrator access can read arbitrary server files, including wp-config.php and /etc/passwd, by injecting crafted <link> tags into page content.

A use-after-free condition exists in pglogical's worker signaling code, where a worker structure can be dereferenced after the underlying slot has been freed or recycled during normal worker lifecycle events. The condition is reachable during normal replication operation, including by a low-privileged user able to influence worker start, stop, and restart timing through permitted pglogical operations. In the typical case the condition crashes replication workers, causing an availability impact. In the worst case a use-after-free in a PostgreSQL backend can be leveraged as a remote code execution primitive at the privilege of that backend.

The apply worker in pglogical does not sufficiently validate field lengths in incoming replication protocol messages before copying them, leading to an out-of-bounds read. An attacker controlling a publishing endpoint can send crafted messages, causing disclosure of process memory or crashing the apply worker.

IBM PowerVM Hypervisor in specified versions allows an attacker with physical access to Transparent Memory Encryption (TME) hardware to decrypt encrypted memory due to insufficient cryptographic entropy.

The Media Cleaner plugin for WordPress up to version 7.0.3 is vulnerable to Server-Side Request Forgery (SSRF). The get_urls_from_html() function uses DOMDocument::loadHTMLFile() to fetch iframe source URLs with insufficient hostname validation, allowing authenticated attackers with Administrator access to make requests to arbitrary locations from the application.

nebula-mesh before version 0.3.2 sets HttpOnly and SameSite=Lax flags on cookies but never sets the Secure flag. A single plaintext request to the origin (e.g., operator on a LAN, mistyped URL, HTTP→HTTPS not strictly enforced, reverse proxy misconfiguration) discloses the session.

In nebula-mesh prior to version 0.3.2, a newly minted operator API key was exposed in the redirect URL, potentially leaking via Referer header, browser history, or proxy logs. This issue has been fixed in version 0.3.2.

In nebula-mesh prior to version 0.3.3, all /ui/* POST/PUT/PATCH/DELETE routes process requests immediately after session cookie validation. SameSite=Lax does not protect against cross-site form submissions from third-party domains (e.g., top-level navigations, sibling-subdomain attacks) or against the GET /ui/logout route. This issue has been fixed in version 0.3.3.