CVE Vulnerability Catalog

In Piwigo before version 16.4.0, admin/themes_standard_pages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension in the filename. An authenticated administrator can upload a file with a server-executable extension, leading to code execution when placed in the logo directory.

InvoicePlane before version 1.7.2 stores and serves uploaded images without stripping EXIF metadata. When an administrator shares an image with another user, the recipient can retrieve GPS coordinates, timestamps, and device information. The vulnerability is fixed in version 1.7.2.

In InvoicePlane before version 1.7.2-rc-1, the permitted template list is built by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file placed in the directory is automatically trusted and can be selected as a public template, then executed when rendering a public invoice.

In InvoicePlane prior to 1.7.2, the administrator-controlled tax_rate_decimal_places setting is interpolated into an ALTER TABLE statement for ip_tax_rates in Settings::index() without strict integer validation. A crafted setting value can add clauses to the schema-changing statement and remove or alter required database columns. The vulnerability is fixed in 1.7.2.

Input Leap through version 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory traversal. This can result in code execution if a file is written to a startup directory via a DDRG message.

A weakness has been identified in Zhonglun CloudPOS 3.0 in the Automatic Update component (file Program.cs). Manipulating the version/url/packagekey/package name arguments can lead to channel accessible by non-endpoint. The attack can be launched remotely, is highly complex, and exploitation appears difficult. The exploit has been made public.

In Google gVisor prior to commit 573a9e73cf844f, on Linux platforms with CUSE enabled, improper exposure of a resource in the host file helper (gofer) allows a local attacker with container image deployment privileges to achieve root code execution on the host. By including a /dev/cuse character device node in a container image, the attacker can register a host device and exploit CUSE unrestricted ioctl handling to overwrite root udev helper memory.

IBM Server Firmware versions FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker on the management network can send a malformed HTTPS request to ASMI, causing the web server to crash with possible memory corruption and generate an error log. The ASMI web interface restarts automatically, but repeated exploitation could result in a sustained loss of access to the ASMI management interface.

FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw.

Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability in jslGetRawString() in src/jslex.c. Crafted raw/binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain(), leading to memory corruption and application termination or denial of service in RELEASE/NO_ASSERT builds.

IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the Universal Connector Oracle Wallet upload component. An authenticated remote attacker could exploit this vulnerability to write arbitrary files to the system.

IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit this vulnerability to execute arbitrary code on the affected system.

This CVE has been rejected or withdrawn by its CVE Numbering Authority.

This CVE has been rejected or withdrawn by its CVE Numbering Authority.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

In the Linux kernel, the smb2_tree_connect() function of the SMB server (ksmbd) leaks a tree connection. When ksmbd_iov_pin_rsp() fails, the newly created tree connection is not disconnected, leading to a resource leak.

In the Linux kernel, the nvdimm (pmem) pmem_submit_bio() function records a REQ_PREFLUSH error but continues to copy bio data and can later overwrite the error with a successful REQ_FUA flush. This allows data writes to run after a failed preflush and can complete the bio successfully despite the failed ordering barrier.