CVE Vulnerability Catalog

Trivy before version 0.71.1 uses the `org.opencontainers.image.title` annotation from the OCI artifact manifest as the destination filename without validation. An attacker who can make Trivy fetch an attacker-controlled artifact can supply a crafted annotation that resolves to a path outside the intended destination, causing Trivy to write the layer content to an arbitrary location on the host filesystem.

LibreChat before version 0.8.4-rc1 allows authenticated users to set a custom URL for OpenAI-compatible API endpoints. This URL is used to construct HTTP requests without any SSRF validation, enabling traffic to be directed to internal network addresses.

A vulnerability in LibreChat before version 0.8.5 allows a malicious MCP server to steal access tokens intended for a legitimate server. The MCP OAuth implementation does not validate that the resource parameter from OAuth Protected Resource metadata (RFC 9728) matches the configured MCP server URL.

HTMLy CMS through version 3.1.1 contains a path traversal vulnerability that allows low-privileged authenticated attackers to relocate arbitrary files by supplying directory traversal sequences in the oldfile parameter at the admin autosave endpoint. Attackers can pass unsanitized traversal sequences directly to file_exists() and rename() functions in admin.php without canonicalization or directory boundary enforcement, causing unintended relocation of any file writable by the web server process to an attacker-specified draft location.

The IPv6 stack in Zephyr can be prevented from receiving or processing future incoming packets by sending a small number of maliciously fragmented IPv6 packets. When such a packet is handled by the fragment-header processing path, the associated RX network packet buffer (allocated from a memory slab) is not released back to the pool. Repeating the malicious packet exhausts all RX buffer slots, after which the device can no longer obtain RX buffers and stops receiving traffic, resulting in a denial of service.

An OS Command Injection vulnerability (CWE-78) in a network service allows unauthorized execution of commands with elevated privileges. The flaw is triggered when a privileged authenticated user interacts with the vulnerable service.

A CWE-476 NULL Pointer Dereference vulnerability could cause a denial-of-service condition, making the device's HMI and configuration functionality unavailable when malformed requests are received over exposed network interfaces.

CWE-522 Insufficiently Protected Credentials vulnerability allows an unauthenticated attacker to access credentials stored in firmware or system files. This can lead to unauthorized access and exposure of sensitive information, and with physical access to the device, full compromise.

In Vim prior to version 9.2.0699, the Python omni-completion function executes reconstructed function and class definitions from the current buffer using exec(). During source reconstruction, each scope's docstring is inserted verbatim between triple quotes without escaping, allowing a malicious buffer to break out of the triple-quoted literal and execute attacker-controlled Python code during omni-completion.

In Vim before version 9.2.0698, the spell_soundfold_sofo() function in src/spell.c has a stack out-of-bounds write vulnerability. The copy loop does not check the bounds of the result buffer, allowing data to be written past the allocated stack memory when processing a word longer than MAXWLEN. This corrupts the call frame and crashes the editor.

In Vim prior to version 9.2.0663, a Vimscript code injection vulnerability exists in s:NetrwLocalRmFile() in the netrw plugin. A filename derived from the buffer's directory listing is interpolated into an Ex command line passed to :execute with only the backslash character escaped, allowing a crafted filename containing a bar (|) to terminate the intended command and execute arbitrary Vimscript, including shell commands via :call system() and :!.

In Vim prior to version 9.2.0653, the tree_count_words() function in src/spellfile.c writes out-of-bounds on the stack when processing crafted .spl/.sug files. An attacker can exploit this vulnerability to crash the editor via stack buffer overflow.

3X-UI is a control panel for managing Xray-core servers. Prior to version 3.3.1, an authenticated administrator could abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database.

List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function. The issue arises from improper memory management, which can lead to memory corruption.

Malicious HTML content contained in the layout specification of a PDF could be executed when the PDF editor is opened in the browser. This allows one backend user to inject JavaScript into the browser context of another backend user.

A vulnerability in the Nokogiri library (versions prior to 1.19.4) for the Ruby programming language allows a Ruby wrapper to point to freed memory when replacing the value of an XML attribute. This can lead to an invalid read and a possible segfault.

Vulnerability in the Nokogiri library for Ruby causes a NULL pointer dereference when calling certain methods on allocated-but-uninitialized native wrapper classes inheriting from Nokogiri::XML::Node. The issue is fixed in version 1.19.4.

Vulnerability in the Nokogiri library (versions prior to 1.19.4) for Ruby. Calling Document#encoding= with an invalid encoding (e.g., non-string or containing a null byte) frees the current encoding string without replacing it. Subsequent calls to Document#encoding read freed memory, potentially causing a segfault or leaking freed bytes into a Ruby String. Affects only the CRuby (libxml2) implementation; JRuby is not affected.

Vulnerability in the Nokogiri library for Ruby allows out-of-bounds memory read via the Nokogiri::XML::NodeSet#[] method (and its alias #slice). The issue stems from incorrect bounds checking where the index is truncated to 32 bits before validation, allowing a very large negative index to pass the check and read outside allocated memory. On CRuby this causes process crashes, on JRuby it returns an incorrect node.

Dell Display and Peripheral Manager (DDPM Mac) versions prior to 2.3 contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability, allowing a low privileged attacker with local access to potentially execute commands.