CVE Vulnerability Catalog

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to an interpretation conflict in the multipart parser.

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known.

In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route (cmsproxy) is vulnerable to a Server-Side Request Forgery (SSRF) attack via DNS Rebinding. A Time-of-Check to Time-of-Use (TOCTOU) race condition exists between the URL validation phase and the actual HTTP request phase, allowing attackers to access internal network resources and cloud metadata endpoints. Version 0.10.4 fixes the issue.

A Server-Side Request Forgery (SSRF) vulnerability in Fortinet FortiSIEM in multiple versions may allow an attacker to execute unauthorized code or commands.

The Estatik Real Estate Plugin for WordPress before version 4.3.4 does not validate the recipient list used for messages sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body, and Reply-To on sites where the form is configured to route to a custom address.

A rogue Velociraptor client can upload a malformed sparse file that causes a panic when the GUI attempts to expand it, potentially crashing the server process. The issue is a Divide by Zero bug in the ShouldPadFile() function.

In sshd in OpenSSH before 10.5, the 'restrict' keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.

In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the [email protected] extension.

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue access-token cookies, and refresh-token cookies when provided by the identity provider, without Secure even though the browser completed login over HTTPS.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to restricted resources. Exploitation of this issue does not require user interaction.

Dozzle is a realtime log viewer for docker containers. From 10.5.2 until 10.6.15, the isBlockedIP SSRF guard in internal/notification/dispatcher/webhook.go, used by safeDialContext for webhook notification URLs, does not inspect IPv4 addresses embedded in 6to4, NAT64, Teredo, or IPv4-compatible IPv6 addresses, allowing an authenticated user to reach loopback or link-local targets that the guard intends to block. This issue is fixed in version 10.6.15.

Integer overflow in UEFI firmware for Intel(R) Slim Bootloader may allow information disclosure. A system software adversary with an authenticated user and low complexity attack may cause denial of service. The attack requires local access and user interaction.

Out-of-bounds write in firmware for Intel(R) Slim Bootloader may allow denial of service. A privileged user with low complexity attack can cause denial of service. The attack requires local access but no user interaction.

Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary code, potentially resulting in binary hijacking.

Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to achieve privileged escalation, potentially resulting in arbitrary code execution.

Vim, an open source command line text editor, from version 9.2.0469 to 9.2.0843 has a vulnerability in popup_mark_opacity_zindex() in src/popupwin.c that can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843.

Vim, an open source text editor, has a vulnerability in json_decode_item() in src/json.c that can retain a stale pointer after json_decode_string() invokes channel_fill(), causing the error path to read freed memory when an invalid JSON string spans buffers. Affects versions from 9.2.0511 to 9.2.0844, fixed in 9.2.0844.

A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected device to become temporarily unavailable.

The vulnerability in cti-transmute renders data from a remote MISP instance into the event-browser interface using HTML interpolation. A malicious or compromised MISP server can return crafted values that inject HTML or script-capable content into the interface.

On the Zephyr ARM port, enabling the hardware FPU (CONFIG_FPU) forces the Floating point ABI choice, which defaults to CONFIG_FP_HARDABI. Both FP_HARDABI and FP_SOFTABI permit the compiler to emit hardware FP instructions in any function, even code that never uses floating-point types. However, the callee-saved FP registers (s16-s31 / d8-d15) are only saved and restored across a context switch when CONFIG_FPU_SHARING is enabled, and prior to this fix selecting an ABI did not enable FPU register sharing, which defaults off.