CVE Vulnerability Catalog

Electron prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8 is vulnerable to a use-after-free when handling fullscreen, pointer-lock, or keyboard-lock permission requests if the app registers an asynchronous `session.setPermissionRequestHandler()`. If the requesting frame navigates or the window closes while the permission handler is pending, invoking the stored callback dereferences freed memory, which may lead to a crash or memory corruption.

Electron before versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8 contains a use-after-free vulnerability in the powerMonitor module. After the PowerMonitor object is garbage-collected, OS resources retain dangling references, leading to crashes or memory corruption on session events (Windows) or system shutdown (macOS).

Electron prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8 has an undocumented commandLineSwitches webPreference that allows arbitrary switches to be appended to the renderer process command line. Apps constructing webPreferences from untrusted configuration objects may allow an attacker to disable renderer sandboxing or web security controls.

In PraisonAI before version 1.5.95, the FileTools.download_file() function does not validate the URL parameter, passing it directly to httpx.stream() with follow_redirects=True. An attacker controlling the URL can reach any host accessible from the server, including cloud metadata and internal services.

PraisonAI before version 1.5.90 contains a command injection vulnerability in the run_python() function. The function constructs a shell command from user input without proper escaping, allowing arbitrary OS command execution before Python is invoked.

PraisonAI prior to version 4.5.90 has a vulnerability in passthrough() and apassthrough() functions that accept a caller-controlled api_base parameter. This parameter is concatenated with the endpoint and passed to httpx.Client.request() without URL scheme validation, private IP filtering, or domain allowlist, allowing requests to any host reachable from the server. The issue has been fixed in version 4.5.90.

Mesop, a Python-based UI framework, from version 1.2.3 to before version 1.2.5 contains an uncontrolled resource consumption vulnerability in the WebSocket implementation. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of OS threads, leading to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS).

In Emlog versions 2.6.2 and prior, a path traversal vulnerability exists in the emUnZip() function, allowing an authenticated admin to write arbitrary files (including PHP webshells) by extracting a crafted ZIP archive with ../ sequences, leading to Remote Code Execution (RCE). No public patch available.

In nimiq/core-rs-albatross (a Rust implementation of the Nimiq Proof-of-Stake protocol) prior to version 1.3.0, the handshake handler accepts a peer-supplied limit of 0 and stores it unchanged. In the HandshakeAck path, limit 0 returns zero contacts, appearing benign. Later, in the Established state, computing self.peer_list_limit.unwrap() as usize - 1 with limit 0 wraps to usize::MAX, causing a panic when attempting memory allocation.

A vulnerability in Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and 07.0.01 allows read-only users to gain write access to managed devices by bypassing access control mechanisms. Attackers can exploit alternative interfaces such as the web interface or SNMP browser to modify device configurations.

OpenPrinting CUPS versions 2.4.16 and earlier contain a vulnerability that allows a local unprivileged user to coerce cupsd into authenticating to an attacker-controlled localhost IPP service with a reusable `Authorization: Local ...` token. This token enables /admin/ requests on localhost, and the attacker can create a persistent printer queue with a file:///... URI despite the FileDevice policy. Printing to that queue allows arbitrary root file overwrite, potentially leading to privilege escalation.

OpenPrinting CUPS versions 2.4.16 and prior have a vulnerability in a network-exposed cupsd with a shared PostScript queue. An unauthenticated client can send a print job, and the server processes a page-border value with an embedded newline, allowing execution of an arbitrary binary (e.g., /usr/bin/vim) as user lp.

OAuthenticator before version 17.4.0 has an authentication bypass vulnerability. An attacker with an unverified email address on an Auth0 tenant can log in to JupyterHub, and if email is used as the username, they can take over accounts.

RAGFlow versions up to 0.24.0 contain a Server-Side Template Injection (SSTI) vulnerability in the TextProcessing and Message components. It allows an authenticated user to execute arbitrary OS commands on the server via unsafe Jinja2 template rendering.

Piwigo prior to version 16.3.0 contains a SQL Injection vulnerability in the Activity List API endpoint. An authenticated administrator can extract sensitive data from the database, including user credentials, email addresses, and all stored content.

Piwigo prior to version 16.3.0 contains a SQL Injection vulnerability in the pwg.users.getList API method. The filter parameter is directly concatenated into a SQL query without proper sanitization, allowing authenticated administrators to execute arbitrary SQL commands.

In Piwigo prior to version 16.3.0, the pwg.history.search API method is registered without the admin_only option, allowing unauthenticated users to access the full browsing history of all gallery visitors.

A vulnerability in Hirschmann HiLCOS Classic Platform switches exposes user passwords synchronized with SNMPv1/v2 community strings transmitted in plaintext. Attackers with local network access can sniff SNMP traffic or extract configuration data to recover plaintext credentials and gain unauthorized administrative access.

Hirschmann HiLCOS devices (OpenBAT, WLC, BAT300, BAT54) before version 8.80 and OpenBAT before 9.10 are shipped with identical default SSH and SSL keys that cannot be changed. This allows unauthenticated remote attackers to decrypt or intercept encrypted management communications.

The Amazon Athena ODBC driver before version 2.0.5.1 on Linux contains an OS command injection vulnerability in the browser-based authentication component. An attacker can use specially crafted connection parameters loaded by the driver during a local user-initiated connection to execute arbitrary code.