CVE Vulnerability Catalog

A local cross-user code execution vulnerability exists in GNU wget (Windows builds from eternallybored.org) due to a hardcoded configuration file path (C:\msys64) that is writable by unprivileged users, allowing for arbitrary code execution via the use_askpass directive, potentially allowing local privilege escalation.

The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:\, which inherits write access for Authenticated Users.

The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded configuration path vulnerability within openssl.cnf path that can allow local code execution.

Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload.

An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a crafted .php file and execute arbitrary PHP code on the server.

CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection() into a no-op on every state-changing admin request, and it does not send the csrf_token hidden field in admin forms. Because administrator authentication is cookie-only and no CSRF token is enforced, an unauthenticated attacker can induce a logged-in administrator's browser to issue a forged content-save request with a text payload containing a scripting marker. The marker is stored verbatim into content/content.php; on every subsequent page view evaluate_cmsimple_scripting() (functions.php) executes the marker body with PHP eval() — for all visitors, including unauthenticated ones. This yields persistent remote code execution on the web server.

MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature.

An integer overflow vulnerability exists in MPack 1.1.1 in mpack_node_cstr_alloc() and mpack_node_utf8_cstr_alloc().

An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e. When an exact-length FlatBuffers schema ends with an unterminated quotation mark, the C-string scanning logic in lex() dereferences the input pointer after it has reached the end of the buffer. A specially crafted schema can trigger a one-byte heap buffer over-read, resulting in application crash and denial of service.

An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e. When an exact-length FlatBuffers schema buffer ends with a digit, the integer digit-scan loop in lex() advances past the end of the input buffer and dereferences the out-of-bounds pointer. A specially crafted schema can trigger a one-byte heap buffer over-read, resulting in application crash and denial of service.

A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can provide a malicious file with an invalid arena configuration (num_buffers=0) that triggers an assertion failure in yr_arena_get_ptr(), causing the application to terminate.

An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The vulnerability is caused by insufficient validation of external-variable pointers, which may lead to invalid free in yr_rules_destroy() or wild pointer access in yr_object_create(). An attacker can provide a specially crafted .yrc file that causes memory corruption and application crash.

A NULL pointer dereference vulnerability exists in the gf_sg_vrml_field_clone() function of GPAC 2d7da22e (26.08-DEV). The vulnerability occurs when cloning a PROTO default SFImage field with a NULL source pointer. An attacker can provide a specially crafted input file that triggers the condition, resulting in application crash and denial of service.

lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device.

Nautobot from 3.0.0 to 3.1.8 does not enforce approver-group membership, change permission, or the one-response-per-user restriction in the generic ApprovalWorkflowStageResponse create endpoint. A user with only extras.add_approvalworkflowstageresponse can submit approved responses directly, and writable user/state fields allow attributing responses to arbitrary users. Forged responses can satisfy min_approvers, approve the workflow, and activate gated ScheduledJobs without a legitimate approver. Fixed in 3.1.8.

Nautobot before 2.4.37 and 3.1.8 allows users with extras.add_relationship or extras.change_relationship to store HTML/JavaScript in Relationship descriptions, and users with dcim.add_modulefamily or dcim.change_modulefamily to store it in Module Family names. These values are rendered as form field help_text via Django's |safe filter without adequate neutralization. Stored content executes in the authenticated browser session of any user, including admins, opening affected forms. Fixed in 2.4.37 and 3.1.8.

Gardener before 1.142.6, 1.143.3, 1.144.2, and 1.145.0 has a vulnerability in the customverbauthorizer admission plugin's manage-members check, which does not account for Group or ServiceAccount subjects in Project.spec.members. A project administrator lacking manage-members permission can add arbitrary Group or ServiceAccount subjects, including system:authenticated, granting broad project access. This can include Shoots, Secrets, and cloud provider credentials. Fixed in 1.142.6, 1.143.3, 1.144.2, and 1.145.0.

SIPGO prior to 1.4.3 contains a vulnerability in WSConnection.Read that does not set MaxFrameSize, allowing an unauthenticated WS or WSS peer to send a frame header declaring an extremely large payload, causing an oversized allocation or a makeslice length panic and crashing or exhausting memory in the server process.

A vulnerability in the Analytics and Location Engine (ALE) API may allow disclosure of sensitive information. An unauthenticated remote attacker could exploit this by providing specially crafted input to a specific API endpoint. Successful exploitation could result in disclosure of sensitive user information, including password hashes, which could be used to facilitate further attacks.

Multiple vulnerabilities in the Analytics and Location Engine (ALE) may allow unauthorized access or denial of service. An unauthenticated remote attacker could exploit these by sending specially crafted input or leveraging improper security configurations. Successful exploitation could result in a denial of service condition or unauthorized access to sensitive information.