CVE Vulnerability Catalog

Mnemosyne before v3.10.1 has a vulnerability in the auth check in mnemosyne/core/sync_server.py where JWT parsing uses base64 and disables signature verification. The server accepts any well-formed token, including those with alg: none or wrong key.

LMDeploy versions 0.12.1 through 0.12.2 contain a code injection vulnerability in lmdeploy/pytorch/config.py line 620. An attacker can execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted quantization_config.quant_dtype value, which is passed to eval() without validation.

Parseable prior to 3.0.0 uses unwrap() while parsing the x-amz-firehose-common-attributes header before authentication. A remote unauthenticated attacker can supply non-UTF-8 header data, malformed JSON, or invalid derived header values that trigger a Rust panic and interrupt request handling.

LMDeploy versions 0.9.2 through 0.16.0 used recv_pyobj() to deserialize messages received over a ZeroMQ PULL socket in the DistServe/PD-disaggregation control plane. PyZMQ implements recv_pyobj() with Python pickle deserialization, which can execute arbitrary code, and the peer address was supplied via the POST /distserve/p2p_connect HTTP endpoint. Without API-key authentication enabled, an attacker could cause the server to connect to an attacker-controlled ZeroMQ endpoint and deserialize a crafted pickle payload, leading to unauthenticated remote code execution.

Mongoid contains an unsafe reflection weakness in the document persistence layer. Passing keys from unauthenticated parties can trigger unintended internal method invocation instead of an array update, potentially causing deletion of stored records and unresponsiveness.

A vulnerability in Mongoid (object-document mapper) involves an insecure direct object reference in nested attributes handling. A user with basic privileges can reference a record identifier that is not their own, causing the record to be looked up without usual ownership restrictions, then updated and linked to the attacker's record.

A flaw was found in Netty's HTTP/2 stack that allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting.

A vulnerability in Forget-C Jellyfish AI Short Drama Studio (versions 0.1.0-alpha to 0.3.2) involves missing authentication in the file backend/app/dependencies.py of the FastAPI component. Remote attack is possible, allowing access to functions without authentication.

In the Self Update Handler component of spatie Scotty up to version 1.4.2, there is a vulnerability where code is downloaded without an integrity check. The SelfUpdater::update function allows remote exploitation.

In the Doctor Command Handler component of spatie Scotty up to version 1.4.4, there is an OS command injection vulnerability via the host argument. The DoctorCommand::checkSshConnectivity and DoctorCommand::checkRemoteTools functions allow remote attack.

The Grandstream GWN7660ELR device before firmware version 1.0.27.6 contains an information disclosure vulnerability. An unauthenticated remote attacker can query the SNMP v2c service configured with the default community string 'public' to retrieve detailed system information.

A vulnerability in Cockpit allows an unauthenticated remote attacker to initiate and sustain numerous simultaneous connections to the cockpit-tls service, forcing it to create an unbounded number of threads and consume system resources such as memory and file descriptors. The result is a denial of service (DoS).

In cockpit-ws, there is a denial-of-service (DoS) vulnerability. A remote unauthenticated attacker can send a specially crafted request that, when WebService.UrlRoot is configured and the exact URL-root prefix is requested without a trailing slash, causes the service to terminate unexpectedly.

A flaw was found in Cockpit. An authenticated local user with a large user identifier (UID) can cause unauthorized modification and disclosure of login records. On 32-bit systems, an integer overflow during session accounting allows the user's login process to read or overwrite the legacy log entries of other accounts.

CareCam CM2507 IP cameras store the root password using a fixed legacy hash that is insufficiently resistant to offline cracking.

A CM2507 IP camera running firmware HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface without authentication. An attacker with physical access can interrupt the boot process and access functionality to inspect or modify boot configuration, firmware data, and software.

A vulnerability in Convoy (webhooks gateway) prior to 26.6.8 affects the GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint. The endpoint authorizes access to the project in the URL, but Handler.GetSource fetches the Source only by sourceID without confirming that its ProjectID matches the authorized project. An authenticated user or project-scoped API key holder can substitute another tenant's Source identifier and receive that Source's complete record, including unredacted AMQP, Kafka, SQS, or Google PubSub credentials.

CM2507 IP cameras store wireless network credentials in cleartext within the device filesystem.

Semantic MediaWiki versions 7.0.0 through 7.1.0 contain a reflected XSS vulnerability in Special:Ask. The 'cursor' parameter is unsigned and fully attacker-controlled; insufficient validation leads to raw HTML injection into the page.

Prior to version 7.2.0, query debug output (format=debug or the 'debug' parameter on Special:Ask) in Semantic MediaWiki is assembled as raw HTML without proper output-context encoding, leading to reflected XSS.