CVE Vulnerability Catalog

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exhaust system resources, causing an application denial-of-service condition, and exploitation does not require user interaction.

js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load() does not bound nesting or dotted-key depth in the recursive parser, so deeply nested arrays, deeply nested inline tables, or long dotted keys can exhaust the V8 call stack and throw a raw RangeError instead of the documented SyntaxParseError. Applications that parse attacker-controlled TOML and handle only SyntaxParseError can rethrow the unexpected exception, which can terminate a worker or process and cause denial of service. The issue does not affect confidentiality or integrity and is fixed in version 1.1.3.

A vulnerability in plone.app.portlets allows an authenticated user who can add or edit a Classic portlet to execute arbitrary code. The user-supplied template/macro fields are evaluated as a full TALES expression, leading to privilege escalation from a web user to the server-side process.

Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/framework/Ip/Ip.class.php from the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are keyed on this value, a remote unauthenticated attacker bypasses IP-based throttling by sending a different X-Forwarded-For value per request.

Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder (pH7 Social Dating CMS) through 19.2.0. The CAPTCHA escalation flag is stored in the PHP session as captcha_admin_enabled and the CAPTCHA form element is only built when that flag is present, so a remote unauthenticated attacker who obtains a new session before each login attempt is never presented with the challenge.

Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could access sensitive files and directories outside the intended access scope, and exploitation does not require user interaction. Scope is changed.

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could bypass security measures and gain unauthorized write access, and exploitation does not require user interaction.

A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function of the file agent-core-v2/src/agent/mcp/config-loader.ts of the MCP Configuration Loader component. The manipulation results in OS command injection. The attack may be launched remotely and the exploit has been released to the public and may be used for attacks. Upgrading to version 0.31.1 fixes this issue.

A vulnerability in Changedetection.io up to 0.55.8. The function setCurrentSelectedText in visual-selector.js is affected. Manipulating the argument s can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed. Upgrading to version 0.60.1 addresses the issue. The patch is aac6fcfa594f17511b8ff73e5eaa4f6c33899de0.

A vulnerability was found in dgtlmoon changedetection.io up to 50389b07, affecting the function add_watch_ui_snapshot in changedetectionio/blueprint/add_watch_ui/__init__.py of the Preview Endpoint component. Manipulation of the url argument results in server-side request forgery (SSRF), and the attack can be initiated remotely. The exploit has been made public and could be used; upgrading to version 0.60.1 resolves the issue (patch 71d332d5a0d3da2a0fe89a392413bf4b7d27c84e).

The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from 'update must be newer' to 'update must be different'. Because the default permission set grants allow-check to the webview, any XSS in the app frontend can invoke this command and bypass the only anti-rollback protection the updater offers. Combined with another bug, this enables downgrade attacks without even needing to fake a higher version number.

Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda function that dispatches caller-supplied parameters to privileged service APIs without authorization validation. Upgrading to version 5.26 or later is recommended; after setup, delete or disable the sfExecuteAWSService function, and if retained, restrict invocation to the intended IAM user only.

MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labelled-VPN NLRI iterators of the routing service. An unauthenticated on-path attacker can send a malformed MP_REACH_NLRI UPDATE message with a prefix-length value below the minimum valid for a labelled-VPN NLRI, which passes validation while describing a route with a negative-length address portion. The fix is carried only in 7.25beta4 (a development build); the current stable release 7.24.2 and the long-term release 7.23.5 both remain affected.

Use After Free vulnerability in RTI Connext Professional (Security Plugins) allows File Manipulation. This issue affects Connext Professional: from 7.6.0 before 7.7.0.1.

Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation does not require user interaction. Scope is changed.

Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation does not require user interaction. Scope is changed.

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPM_SAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a sessionInfo pointer and dereferences its nbFile, files, and sessionFilePathName members without checking for null. A process running at the same or a higher Windows integrity level on the same desktop can send NPPM_SAVESESSION with a null lParam, immediately terminating Notepad++ and causing denial of service and loss of unsaved documents. This issue is fixed in version 8.9.8.

Notepad++ prior to 8.9.8 contains a stack buffer overflow in NppParameters::writeSession because a session path derived from the -settingsDir= option is copied into backupPathName[MAX_PATH] without bounds checking. A sufficiently long settings directory causes the buffer to overflow when Notepad++ saves the session, terminating the process via its stack canary and causing denial of service.

Notepad++ from 8.9.7 until 8.9.8 allows the updater and signature verification path to accept a modified GUP.exe file whose embedded certificate metadata remains present even though its Authenticode digest is invalid. An attacker who can replace or plant the updater-related file can cause Notepad++ to launch attacker-modified code when a user triggers the updater path, though the issue does not provide remote code execution by itself.