CVE Vulnerability Catalog

A flaw was found in hivex where a specially crafted Windows registry hive file can trigger an out-of-bounds memory read when parsing registry values containing malformed large data block lists. This can cause the application processing the registry file to crash.

A vulnerability was detected in EchoHS GeekezBrowser up to 1.7.2/1.8.0 affecting an unknown part of the /api/status file of the Public API component. The manipulation results in information disclosure and requires a local approach. The exploit is public and may be used.

Dell Alienware Command Center (AWCC) versions prior to 6.14.54.0 contain an Improper Authorization in Handler for Custom URL Scheme vulnerability. A low privileged attacker with remote access could exploit it, leading to Client-Side Request Forgery.

Dell Alienware Command Center (AWCC) versions prior to 6.14.54.0 contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with local access could exploit it, leading to Information Tampering, Denial of Service and Spoofing of Application Notifications.

The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load_extended_attrs() in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attr_size of 1 to 15 to read past the allocation and crash analysis tools like istat or icat.

inih before r63 contains a one-byte stack buffer under-read in ini_parse_stream() in ini.c that allows attackers to read abyss[-1] via an embedded NUL byte after an overlong line. Attackers can supply an INI file or string with a line of at least INI_MAX_LINE-1 bytes followed by a NUL byte, causing undefined behavior reported by memory sanitizers.

An integer overflow vulnerability exists in the Qt XML parsing functionality (Qt5Compat / QXmlSimpleReader). It may cause incorrect parser behavior when processing crafted XML data.

@fastify/cors is the CORS plugin for the Fastify web framework. In versions 8.2.0 through 11.3.x, an application that registers the plugin with the non-default onSend hook option crashes on a CORS preflight. On an OPTIONS request carrying the Origin and Access-Control-Request-Method headers, the plugin calls reply.send from inside the onSend hook and re-enters the send pipeline, so a second write of the response headers throws an uncaught ERR_HTTP_HEADERS_SENT that can terminate the Node.js process when no process-level handler is installed.

A memory corruption vulnerability exists in the QMqttClient class of the Qt MQTT module. Under certain MQTT 5 connection settings between client and server, QMqttClient may corrupt memory, which can cause the application to crash.

A permission control vulnerability exists in the Optimizer module. Successful exploitation of this vulnerability may affect service confidentiality.

A permission control vulnerability exists in the background task management module. Successful exploitation of this vulnerability may affect service integrity.

A weakness was identified in the CloudClassroom-PHP-Project in some unknown processing of the Global Session Handler component. Manipulation can lead to session expiration, and the attack may be launched remotely. The attack complexity is high and exploitability is assessed as difficult; the exploit is publicly available and the vendor did not respond to the disclosure.

Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 returns stored field values in object update responses without checking read access. Clients whose class-level permissions or object ACLs allow update but not read can see object data, including atomic operation results, Cloud Code trigger-set values, and whole parent fields under dot notation in certain conditions.

Nuxt from 4.6.0 before 4.6.2 contains a route parameter confusion vulnerability in getRouterParam and getRouterParams. Attackers can return a parameter value different from the one h3 matched by sending paths containing an encoded question mark (%3F), so authorization checks use the Nuxt helper value while resource selection uses event.context.params.

Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set Content-Security-Policy headers on a page whose render request handler is wrapped in more than one IRequestHandlerDelegate. The framework unwraps only a single delegate level when deciding whether a request renders a page, so with a deeper chain, for example an application-provided delegating request mapper combined with CryptoMapper, the page is served without any CSP header even though CSP is enabled, and no error or warning is raised. The nonce-based protection Wicket applies to inline scripts and styles, together with any other CSP directives configured by the application, is thereby lost for those pages, exposing them to content injection the policy was meant to prevent. Applications on stock Wicket that do not wrap request handlers themselves are not affected. Versions before 10.10.0 and 9.24.0 handled nested delegates correctly.

Apache Wicket performs security checks in the wrong order in ResourceIsolationRequestCycleListener: the target page is obtained before the resource isolation policies are consulted, because those policies are passed that page. As a result, RestartResponseAtInterceptPageException is thrown from inside the listener before any policy runs, so a cross-origin request is not refused. The stored destination URL, including its query string, is later used after sign-in, allowing another origin to influence form field values passed to Form#onSubmit().

The vulnerability in Apache Wicket is insufficient session expiration in native WebSocket support. A WebSocket connection keeps a copy of the HTTP session from when it was opened, so invalidating the session via the container (idle timeout, logout, filter invalidate) does not end the connection — subsequent frames still resolve the revoked identity and its attributes.

Apache Wicket fails to check authorization before invoking onMessage() callbacks in WebSocketBehavior. A client message is delivered to every WebSocketBehavior on the page, even when the component it is attached to is hidden, disabled, or denied by IAuthorizationStrategy — unlike Ajax behaviors, which perform this check.

A security flaw was discovered in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P devices (version ESW_1.0(1)B1P48) in an unknown function of set_cloud_serverUrl.cgi, part of the Cloud Management component. Manipulating the url argument results in cross-site scripting (XSS). The attack can be launched remotely and the exploit has been publicly released.

In the lud jsv library (versions from 0.1.0 before 0.26.2) an improper check for unusual or exceptional conditions exists in the pattern and patternProperties keywords. JSV.Helpers.RegexExt.bounded_match?/2 calls :re.run/3 without :report_errors, so exhausting the backtracking budget returns :nomatch just like a real non-match, allowing schema validation bypass. Only schemas whose regex explores a catastrophic branch before the matching branch are affected.