CVE Vulnerability Catalog

Flaw in libstdc++. Integer overflow when processing large inputs to aligned operator new may lead to undersized memory allocation, potentially causing memory corruption or application instability.

A path traversal vulnerability was found in changedetection.io up to version 0.60.7, affecting the static_content function in changedetectionio/flask_app.py within the visual_selector_data component. Manipulating the filename argument allows remote exploitation. The exploit has been publicly disclosed and may be used by attackers.

changedetection.io up to version 0.60.7 has a path traversal vulnerability in the static_content function in changedetectionio/flask_app.py in the Screenshot Handler component. Manipulating the filename argument allows a remote attack with high complexity and difficult exploitability. The exploit has been published, but the vendor did not respond.

A vulnerability was found in changedetection.io up to 0.60.7 in the check_authentication function of changedetectionio/flask_app.py within the Authentication Hook component. Improper validation leads to improper authentication, and the attack can be performed remotely. The exploit has been publicly disclosed and may be used; the vendor did not respond to the disclosure.

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass in the REST API. The flaw allows unauthorized access to protected API functionality.

changedetection.io up to version 0.60.7 has a vulnerability involving an observable timing discrepancy in the check_password function in changedetectionio/flask_app.py in the Hash Comparison component. The attack can be performed remotely, requires high complexity, and is difficult to exploit. The exploit has been published, and the vendor did not respond.

ZenHive mpp (from 0.14.0 before 0.16.2) has improper validation of specified quantity in input. A client with an open payment channel can obtain paid resources without being charged because a voucher with the same cumulative amount is treated as an idempotent success and maybe_spend/2 is not called. The same signed voucher can be re-presented under new challenges, yielding an unbounded number of paid units.

ZenHive mpp (from 0.14.0 before 0.16.2) is vulnerable to authentication bypass by capture-replay. An attacker holding a captured subscription activation credential can repeatedly charge the payer because the signed authorization is not tied to the challenge and activation deduplication is keyed by challenge id. Each replay triggers a new first-period settlement and re-authorizes the server key.

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client.

LibreOffice can import PICT images, which may be embedded in documents. An out-of-bounds read occurs when importing an image that uses a colour palette because the palette index is not checked against the number of entries. In fixed versions, the palette index is limited to the entries present.

In LibreOffice, URLs could be constructed that expand environment variables or INI file values, potentially exfiltrating sensitive information to a remote server when opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content provider, so a URL naming it differently still reached the expansion. In fixed versions, the package content provider is matched when the URL is checked.

LibreOffice converts CFF fonts to Type 1 when subsetting a font, which occurs when exporting a document to PDF; CFF fonts may be embedded in documents. A stack buffer overflow exists in this conversion because converted operators are written into a fixed-size buffer without checking if they still fit. In fixed versions, the remaining capacity is tracked and conversion stops when it is used up.

LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow exists when reading the hints of a glyph because the number of hints is checked against the wrong bound. In fixed versions, the hint count is checked against the actual capacity of the array.

LibreOffice Draw can import PDF documents. A heap buffer overflow exists when importing a stream object because the stream length is taken from its own dictionary and not checked against the actual number of bytes present. In fixed versions, the declared length is clamped to the bytes actually read.

LibreOffice Draw can import PDF documents. A heap buffer overflow exists when importing an encrypted document because the decryption key length is taken from the document's encryption dictionary and used to fill a fixed-size key buffer without being checked. In fixed versions, a declared key length larger than the buffer is rejected.

LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow exists when importing a text record that carries its own character advance widths because the count of advance values and the text length are read separately and not required to agree. In fixed versions, an advance array shorter than its text is ignored.

The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope, allowing an attacker to reach disallowed destinations such as cloud metadata endpoints, localhost services, or internal network hosts.

In Checkmk versions <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL), insufficiently protected credentials in host and folder configuration endpoints of the REST API allow an authenticated user who may view a host's configuration to read stored SNMP community strings, SNMPv3 auth and privacy pass phrases and IPMI passwords in clear text from GET responses, although the setup GUI never displays these values.

Improper neutralization of newlines in filter values in the monitoring host and service list APIs in Checkmk <2.5.0p14 allows an authenticated user to inject additional Livestatus query headers, bypassing object visibility restrictions in count queries to infer information about hosts and services outside their contact groups and occupying web server and Livestatus workers for an attacker-controlled duration.