CVE Vulnerability Catalog

The Events Made Easy plugin version 3.1.3 and earlier contains an unauthenticated broken access control vulnerability. An attacker without authentication can gain unauthorized access to functions or data.

Mattermost versions 11.6.x through 11.6.5, 10.11.x through 10.11.20, 11.8.x through 11.8.1, 11.7.x through 11.7.4 fail to limit the number of frames and enforce the file size cap on animated GIF uploads. An authenticated attacker can cause a denial of service via a crafted animated GIF uploaded as a custom emoji.

Mattermost versions 11.8.x through 11.8.0, 11.7.x through 11.7.3, 11.6.x through 11.6.5, 10.11.x through 10.11.20 fail to bound the time and resource consumption of server-side document content extraction. An authenticated user with file-upload permission can degrade file uploads for all users by repeatedly uploading small documents that are cheap to upload but expensive to extract, saturating the shared extraction worker pool.

Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a directory traversal vulnerability in Configuration Management. An attacker can change directory permissions, denying access to legitimate users.

Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the cluster and knowledge of the hardcoded credential can read alarm and alert information.

A vulnerability in Ericsson Packet Core Controller (PCC) before version 1.39 allows an attacker to enumerate other users on the system through exposure of sensitive system information in the Configuration Management module.

A vulnerability in Ericsson Packet Core Controller (PCC) before version 1.39 allows an attacker to execute specially crafted commands that reveal system secrets through error messages in the Configuration Management module.

A vulnerability in the node-unzipper library up to version 0.12.3 in the Extract function of lib/extract.js allows a path traversal attack. The attack requires local access, and the exploit has been publicly disclosed.

A vulnerability in the GNU Binutils linker causes a heap-buffer-overflow read when processing a specially crafted 32-bit XCOFF object file. An attacker can provide a malicious file, leading to heap data disclosure and linker crash (DoS).

A vulnerability in Apache Thrift Python bindings before version 0.24.0 involves improper validation of certificate with host mismatch, enabling man-in-the-middle attacks.

An XXE vulnerability in proCertum SmartSign before version 9.4.3.90 allows parsing of external XML entities from crafted signature files, enabling SSRF and potentially local file reading. The vulnerability triggers simply by previewing a file in the selection window.

A vulnerability in proCertum SmartSign before version 9.4.3.90 opens CPS URI without schema validation. An attacker can craft a certificate with a URI pointing to a local executable or URL, and when the victim opens the document, the file is executed.

A vulnerability in Apache Thrift C++ bindings before version 0.24.0 causes a buffer over-read, potentially leading to data disclosure or crash.

A stored XSS vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0. Insufficient validation of SVG files allows an authenticated low-privilege user to upload a malicious SVG with JavaScript. When an administrator views the file, the code executes in their browser context.

The Mercusys MB115-4G device contains a DoS vulnerability due to a stack buffer overflow in the http_gdpr_decrypt function of the web interface, exploitable by an unauthenticated attacker via a crafted request to /cgi/login.

Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call (for example via prompt injection) can supply a crafted public hostname that resolves to loopback or another internal address, or a public URL that redirects to such a target, and thereby reach internal network services that the denylist was intended to block. FetchURL is included in the default auto-approve tool set, so the call does not require interactive user confirmation in manual mode.

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to path traversal vulnerabilities.

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability.

Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milestone IDs through the JSON-RPC API to access project planning information, milestone titles, descriptions, and timelines across all projects on the instance regardless of project membership.

The Calendar WordPress plugin before version 1.3.18 does not properly escape a user-supplied event field before outputting it in an HTML attribute on a public page. Users with the Contributor role can inject arbitrary JavaScript that executes in the browser of anyone viewing the calendar.