CVE Vulnerability Catalog

A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT <func:result> elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes.

WeGIA prior to version 3.5.1 has a Reflected Cross-Site Scripting (XSS) vulnerability in the /html/atendido/cadastro_atendido_parentesco_pessoa_nova.php endpoint, allowing attackers to inject malicious scripts in the idatendido parameter. This vulnerability is fixed in 3.5.1.

HCL Unica MaxAI Workbench is vulnerable to improper input validation. This allows attackers to exploit vulnerabilities such as SQL Injection, XSS, or command injection, leading to unauthorized access or data breaches, etc.

HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can exploit this information to launch targeted attacks, such as remote code execution or denial of service.

In GNU Binutils 2.45, the elf_x86_64_relocate_section function in elf64-x86-64.c of the Linker component has a heap-based buffer overflow. The attack can only be executed locally, and the exploit has been publicly disclosed. It is recommended to deploy the patch named 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0.

In GNU Binutils 2.45, the _bfd_x86_elf_late_size_sections function in bfd/elfxx-x86.c of the Linker component has an out-of-bounds read. The attack needs to be approached locally, and the exploit has been made public. The patch is identified as b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a.

A vulnerability in OpenSSH before version 10.1 allows the null character ('\0') in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.

A vulnerability in OpenSSH before version 10.1 allows control characters in usernames from potentially untrusted sources, such as the command line or %-sequence expansion in configuration files. This can lead to code execution when a ProxyCommand is used.

Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor).

The openml/openml.org web application version v2.0.20241110 uses incremental user IDs and insufficient email ownership verification during email update workflows. An authenticated attacker controlling a user account with a lower user ID can update their email address to that of another user with a higher user ID without proper verification. This results in the victim's email being reassigned to the attacker's account, causing the victim to be locked out immediately and unable to log in. The vulnerability leads to denial of service via account lockout but does not grant the attacker direct access to the victim's private data.

A vulnerability was detected in GNU Binutils 2.45 affecting the dump_dwarf_section function in binutils/objdump.c. Manipulation results in an out-of-bounds read. The attack requires local access and the exploit is now public.

A vulnerability was determined in westboy CicadasCMS 1.0. The issue affects the Add Department Handler in /system/org/save. Manipulation of the argument Name causes cross site scripting. The attack can be carried out remotely and the exploit is public.

The OpenSSL backend in glib-networking fails to properly check the return values of memory allocation routines. An out-of-memory condition could potentially result in writing to an invalid memory location.

In Total.js CMS 1.0.0, the layouts_save function of the Layout Page component in /admin/ is vulnerable to cross-site scripting (XSS) via manipulation of the HTML argument. The attack can be initiated remotely, and the exploit has been publicly disclosed. The vendor did not respond to the disclosure.

NVIDIA CUDA Toolkit for all platforms contains a vulnerability in cuobjdump where an attacker may cause a stack-based buffer overflow by getting the user to run cuobjdump on a malicious ELF file. A successful exploit of this vulnerability may lead to arbitrary code execution at the privilege level of the user running cuobjdump.

SoftIron HyperCloud 2.5.0 through 2.6.3 may incorrectly add user SSH keys to the administrator-level authorized keys under certain conditions, allowing unauthorized privilege escalation to admin via SSH. Affects non-production debug and internal development builds.

A vulnerability has been found in youth-is-as-pale-as-poetry e-learning 1.0. The function encryptSecret in JwtUtils.java of the JWT Token Handler component leads to insufficiently random values. The attack can be initiated remotely but is difficult to exploit.

A cross-site scripting vulnerability was identified in Portabilis i-Educar up to version 2.10, affecting the file /intranet/educar_funcao_cad.php (Editar Função Page component). Manipulation of the abreviatura/tipoacao arguments allows remote exploitation. The exploit has been publicly disclosed and could be used.

A vulnerability was identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /intranet/educar_calendario_anotacao_cad.php. Such manipulation of the argument nm_anotacao/descricao leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

Element Web and Element Desktop before version 1.11.112 have insufficient validation of room predecessor links, allowing a remote attacker to attempt to impermanently replace a room's entry in the room list with an unrelated attacker-supplied room. While the effect is temporary, it may confuse users into acting on incorrect assumptions. The issue has been patched and users should upgrade to 1.11.112.