CVE Vulnerability Catalog

IBM i 7.6 contains an out-of-bounds write vulnerability that could allow a remote attacker to cause a denial of service.

IBM i versions 7.6, 7.5, 7.4, and 7.3 use uninitialized memory during ASN.1 length processing, which could allow a remote attacker to cause a denial of service.

IBM i versions 7.6, 7.5, 7.4, and 7.3 contain an improper authentication vulnerability during NTLM session negotiation, which could allow a remote attacker to access server resources with the privileges of an authenticated user.

IBM i versions 7.6, 7.5, 7.4, and 7.3 contain a stack-based buffer overflow vulnerability that could allow a remote attacker to cause a denial of service and potentially obtain sensitive information.

IBM i versions 7.6, 7.5, 7.4, and 7.3 contain an improper privilege management vulnerability that could allow a remote authenticated attacker to obtain unauthorized privileges.

IBM i versions 7.6, 7.5, 7.4, and 7.3 contain an untrusted search path vulnerability that could allow a remote authenticated attacker to execute arbitrary code.

IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 are vulnerable to arbitrary code execution on Windows when installed for all users due to a publicly writeable directory.

IBM Storage Scale versions 5.2.3.0 through 5.2.3.8 and 6.0.0.0 through 6.0.1.0 contain a hardcoded token in the GUI source code, used for inter-node cluster communication and REST API authentication between GUIs.

IBM Planning Analytics 2.0 and 2.1 Local is vulnerable to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

vantage6 version 5.0.2 and earlier has an algorithm-store edit permission lacking an ownership check, allowing one algorithm developer to alter another developer's algorithm while it is pending or under review. The attacker can change metadata including the algorithm image or image tag, causing reviewers and nodes to trust a different image from the one originally submitted. No fixed version is available as of this review.

SVGO (SVG Optimizer) is a Node.js library and CLI for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin (removeScriptElement in versions 1-3) can leave executable content in optimized SVGs because it does not remove namespaced or prefixed script elements such as <svg:script> and, in versions 3 and 4, matches JavaScript URIs case sensitively. Applications processing untrusted SVG input with this plugin enabled and serving the result can allow scripts to execute when another user opens the SVG, exposing local storage or cookies. Fixed in versions 2.8.3, 3.3.4, and 4.0.2.

phpList before 3.7.0-RC5 contains a CSRF vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request (?page=admins&delete=N) that is not protected by a CSRF token (the central verifyCsrfGetToken check uses enforce=false and is bypassed when the token parameter is absent). A remote attacker can trick a logged-in super-administrator into loading a crafted URL (e.g., embedded as an image in an email) to delete any non-self administrator account.

Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to internal addresses, allowing them to reach arbitrary internal HTTP services and exfiltrate responses including cloud metadata.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper privilege management.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication metadata due to a buffer overflow.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of client-asserted identity.

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. Fixed in version 5.2.2.

fast-xml-parser versions 5.9.3 through 5.10.1 have a vulnerability related to processing multiple DOCTYPE declarations in a single XML document. The addInputEntities() function resets entity expansion limits on each call, allowing bypass of protections and potentially causing excessive CPU usage, event-loop blocking, memory exhaustion, and process termination. The issue is fixed in version 5.10.1.

py-libp2p version 0.7.0 and earlier has a vulnerability in the handle_incoming() method in yamux, which reads an attacker-controlled DATA frame length before validation. After completing the standard Noise handshake, an adversary can send a frame with length 0xFFFFFFFF and withhold the body, blocking the yamux read loop and preventing progress on all streams of the connection. No fixed version is available as of this review.

node-tar prior to version 7.5.21 has a vulnerability in the filesFilter function in src/list.ts, which uses the recursive mapHas helper to walk an archive entry path without a segment cap. A crafted GNU L or PAX x long-path header with thousands of segments can cause an uncatchable RangeError stack overflow, terminating asynchronous and streaming Node.js consumers. The issue is fixed in version 7.5.21.