CVE Vulnerability Catalog

phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. It does not contain a valid vulnerability description.

SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server (scripts/aetherbrowser/api_server.py) exposes the POST /api/ops/check-email endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the email_reader.py subprocess, which connects to configured ProtonMail or Gmail accounts via IMAP and returns email metadata (sender, subject, body snippet) in the JSON response. The server binds to 0.0.0.0:8100 by default with CORS set to allow_origins=["*"], making it reachable from any network or browser origin. Version 4.2.1 patches the issue.

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected.

Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap based Out-of-Bounds Write via Integer Overflow in LERC versions 4.1.0 and earlier may allow a remote, unauthenticated attacker who can pass specifically crafted attacker controlled imagery to an application that uses LERC to crash the application, leading to a denial of service.

RustDesk before 1.5.0 on Windows fails to enforce the one-way file transfer option against peer clipboard file requests, allowing authenticated peers to read files from the host clipboard. Attackers can send FormatDataRequest and FileContentsRequest messages to retrieve copied files by guessing the FileGroupDescriptorW format identifier.

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full responses from the proxy server.

Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access controls.

GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails with PHP attachments to monitored mailboxes, which are written to the web-accessible upload/ticket directory and executed when accessed.

RustDesk versions before 1.5.0 fail to properly validate file transfer permissions on incoming file clipboard messages in the Cliprdr message handler on Linux and macOS. Authenticated remote peers with disabled file transfer permissions can place files onto the host clipboard and retrieve copied files and contents from the process-wide clipboard cache.

pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerability in dimensional patch WKB deserialization that allows authenticated database users to read adjacent heap memory. Attackers can supply crafted pcpatch values with attacker-controlled size fields to copy heap memory into stored patches for exfiltration or crash the PostgreSQL backend.

The Wikibase extension for MediaWiki contains a Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions before 1.46.1, 1.45.5, and 1.43.10.

The Wikipedia Android App exposes sensitive information to unauthorized actors, allowing access, interception, or modification of HTTP cookies. This issue affects the main branch of the application.

The Translate extension for MediaWiki has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. This issue affects versions before 1.46.1, 1.45.5, and 1.43.10.

Vulnerability of sensitive information exposure to unauthorized actor in Mediawiki WikiLambda Extension. Affects version 1.47.0-alpha and has been remediated on the master branch.

Cross-Site Scripting (XSS) vulnerability in Mediawiki TemplateSandbox Extension due to improper input neutralization during web page generation. Affects versions before 1.46.1, 1.45.5, and 1.43.10.

CliInvoke (and its formerly named AlastairLundy.CliInvoke) are .NET libraries for invoking command-line programs. Versions 2.0.0-2.8.4, 2.9.0-2.9.3, 2.10.0-2.10.4, 3.0.0-alpha.1-3.0.0-beta.1 (CliInvoke) and 2.0.0-alpha.1-2.0.0 (AlastairLundy.CliInvoke) contain an argument-injection vulnerability in `RunnerProcessFactory` (2.x line) and `RunnerConfigurationFactory` (3.x line). These factories combine runner arguments, a caller-controlled target, and caller-controlled arguments into one `ProcessStartInfo.Arguments` string, allowing a double quote to break quoting and inject unintended elements into the runner's argument vector, potentially resulting in arbitrary command execution.

The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behavior and may not trigger. When the check is optimized away, a malicious SOAP server can cause allocation of a buffer too small, leading to heap buffer overflow.

Reflected XSS vulnerability in Mediawiki Cargo extension due to improper input neutralization during web page generation. Affects versions through 3.9.4.