CVE Vulnerability Catalog

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database.

Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags. An attacker can supply an image with such an entry, leading to heap data leakage into the exif_* tag.

go-git prior to versions 5.19.2 and 6.0.0-alpha.5 has a vulnerability where worktree operations (checkout, status, add) resolve symbolic links without confining resolution to the worktree boundary. A maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory.

ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attackers with write access to a shared artifact store to execute arbitrary code by planting a malicious pickle file. Attackers can replace a stored artifact.pkl file with a crafted cloudpickle payload containing a malicious __reduce__ method, which executes arbitrary system commands when any user or pipeline materializes the artifact.

In absinthe_federation from 0.1.0 before 0.9.3, there is a vulnerability of allocation of resources without limits, allowing an unauthenticated remote attacker to abort the Erlang VM via crafted _entities representation keys. Every key of every object in the representations argument is converted with String.to_atom/1, and atoms are never garbage collected, leading to exhaustion of the atom table and node crash.

A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption. This is due to improper boundary checks for content in XAR files during scanning.

A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption. This is due to improper boundary checks, which may result in an out-of-bounds buffer read.

A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption. This is due to improper boundary checks, which may result in an out-of-bounds buffer read.

A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption. This is due to improper handling of an endian conversion operation, which may result in an out-of-bounds buffer write.

A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other impacts due to memory corruption. The issue is caused by improper boundary checks in PESpin files during scanning, which may result in an integer overflow. An attacker could exploit this by submitting a crafted file with PESpin content to be scanned by ClamAV.

A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition. The issue is due to improper memory handling when processing zip files during scanning. An attacker could exploit this by submitting a crafted zip file for scanning.

A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition. The issue is due to improper boundary checks for zip file content during scanning, which may result in an out-of-bounds write. An attacker could exploit this by submitting a crafted zip file for scanning.

A vulnerability was found in SourceCodester Photo Share Website 1.0. It affects an unknown function in the file /social/ajax.php?action=signup. Manipulation of the email argument results in SQL injection. Remote exploitation is possible. The exploit has been made public and could be used.

Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user with the nx-datastores-update permission could set the connectionInitSql property to execute arbitrary SQL against the configured database on every new connection. On the default H2 database backend, this could be leveraged to achieve remote code execution as the Nexus process user.

A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their own role to grant broader permissions than they were authorized to hold, including full administrative access, without any additional authorization check or role reassignment.

Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed. A user already logged in at the time of one of these actions could continue using their existing session to interact with the repository as though the account were still active, until that session independently expired. Depending on the permissions previously held, this could allow continued unauthorized access to read, modify, or delete repository content after access was intended to be revoked.

Nexus Repository 3 had an endpoint for changing the administrator password during initial onboarding. It did not verify that onboarding was still in progress, relying on a local artifact. An account with nexus:* permission could invoke the endpoint outside the intended flow to replace the admin password, and existing sessions were not invalidated.

An account holding the nexus:settings:update permission in Nexus Repository 3 (or the equivalent nexus:settings permission in the legacy Nexus Repository 2) could submit arbitrary values as realm identifiers through an internal configuration API that did not validate them against the set of registered realms. Because unrecognized entries were persisted and re-evaluated on every realm load via a legacy code path, this could result in unintended code executing inside the Nexus Repository process, and in some cases a persistent authentication lockout that was not visible through the administrative UI.

Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with permission to manage privileges could, under certain role configurations, escalate their own access to full administrator by exploiting a type-confusion flaw in the privilege update endpoint.

A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, when parsing malformed TTF files. The issue is in the stbtt__GetGlyphShapeTT() function in stb_truetype.h, triggered when an application loads, bakes, or renders a malicious font.