CVE Vulnerability Catalog

An SMTP command injection vulnerability exists in the data-source testing functionality of Zimbra Collaboration Suite (ZCS). An authenticated user can inject CR/LF into the emailAddress in an SMTP envelope command, and after a successful POP3 or IMAP login Zimbra sends the injected commands to the SMTP service.

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability. Attackers can break out of HTML script elements by ending serialized function source text with an unescaped </script.

In baserCMS versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public mail message API endpoint does not enforce the form's auth_captcha setting. An unauthenticated attacker can automate submissions without solving the captcha.

In baserCMS versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in a public mail form's email field, causing a single auto-reply to be addressed to multiple third parties.

In baserCMS versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-file view permission can traverse outside the theme directory through the optional BcThemeFile plugin. This can disclose application source and database credentials in config/install.php.

conda-forge repositories at commits 85748ad2368a and prior contain two React components that render externally-sourced strings directly as HTML using dangerouslySetInnerHTML without sanitization. Error/status strings embed raw output from build processes (logs, patches, tracebacks) which the website renders verbatim as HTML.

Event Schedule versions 1.0.0 and prior contain a bypass of the SSRF guard App\Utils\UrlUtils::isUrlSafe() applied to user-supplied import URLs. Two bypass methods reach internal/localhost services when the URL is later fetched by ImportCuratorEvents (Http::get) and file_get_contents for ogImage.

Signal K Server from 2.28.0-beta.2 before 2.34.0 contains an SSRF vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loopback, vessel network, or cloud metadata endpoints, with image responses stored and served via the admin UI.

@pdfme/common from 5.5.10 before 6.2.6 contains an SSRF vulnerability that bypasses the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames to read loopback, internal or cloud metadata responses through generated documents.

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed server-side when they submit a form whose stored configuration does not carry the relevant setting.

Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_id. Attackers can call the conversations create endpoint with another account's source_id to create or retrieve conversations and post messages to that account's contacts.

RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes ply_read_list_property() call an out-of-bounds handler, crashing ASCII parsing or corrupting memory in binary parsing.

The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form.

The plug_crypto library in Elixir exposes sensitive information (including the secret key base) in application logs when a wrong-typed argument is passed to public functions. Because type validation happens in function-head guards, a failed guard raises FunctionClauseError with the actual argument values in the top stack frame, and the library's rescue blocks and prune_args_from_stacktrace/1 never catch guard failures. Plug.Cowboy and Bandit write that frame to the error log and attach it as crash_reason Logger metadata, which error trackers forward.

JweDirectDecryptorBlock.Decrypt read a 64-bit plaintext length from the _thales_aad protected-header field and used it without any validation. A truncated field panics binary.BigEndian.Uint64, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with a slice-bounds error.

JweRsaKeyEncryptionDecryptorImpl.Decrypt passed the JWE's initialization vector to cipher.AEAD.Open without checking its length. The Go standard library panics rather than returning an error when a GCM nonce is not exactly NonceSize() bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine.

gose parsed the JWS crit header into JwsHeader.Crit and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand; gose implements no header extensions, so every token carrying a non-empty crit should have been rejected — and none were.

LoadPublicKey resolved an EC key's curve with an unchecked type assertion, algToOptsMap[alg].(*ECDSAOptions). A JWK declaring "kty":"EC" together with a non-EC "alg" — which RFC 7517 §4.4 permits — reaches that assertion and panics.

JwtClaims.MarshalJSON built a Go struct at runtime with reflect.StructOf, synthesising a field named "A" + claimName for each untyped claim. reflect.StructOf panics when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT claim names.

jwkFields.CheckConsistency detected duplicate key_ops entries using a pairwise nested loop, making validation cost grow with the square of the entry count. Because the check runs on every JWK and JWKS unmarshal, a modestly sized but hostile JWKS document could occupy a CPU core for many seconds.