CVE Vulnerability Catalog

ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile() function fails to update the file extension after MIME validation, allowing a .php extension to persist and execute via PHP-FPM.

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability. An authenticated user can submit the msg_id parameter as an array to bypass the clean_requests() sanitization function in ClipBucket.class.php, then inject the unsanitized message ID into a SQL query in cb_pm::delete_msg().

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability. An authenticated user can submit the check_photo parameter as an array to bypass the clean_requests() sanitization function in ClipBucket.class.php, then inject unsanitized values into a SQL query in photo_exists() in photos.class.php.

A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare circumstances.

The net_icmpv6_send_error() function in the Zephyr network stack implemented only one of the three RFC 4443 section 2.4 suppression rules, so it did not check whether the packet's source address identifies a single node or whether the packet was sent to a multicast destination. An unauthenticated attacker on the same link can send a single IPv6 packet to ff02::1 with a spoofed victim source, causing every Zephyr node to emit ICMPv6 Parameter Problem messages to that victim (reflection with amplification), or send a unicast packet with a multicast source address, turning it into a link-flooding multicast frame.

The gptp_mi_qualify_announce() function in Zephyr's gPTP subsystem processes received Announce messages by comparing clock identities. The comparison loop uses an attacker-controlled step count (steps_removed) instead of the actual number of TLV entries, leading to an out-of-bounds read. A single frame can cause about 2KB of overread, potentially crashing the networking RX thread and causing denial of service.

The gptp_handle_msg() function in Zephyr RTOS does not validate the received frame length before dereferencing the gPTP header pointer. A truncated frame can lead to out-of-bounds reads, disclosing stale memory contents.

A resource exhaustion flaw exists in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can send a specially crafted DER payload, causing excessive memory allocation based on an inflated length value without proper validation, leading to JVM memory exhaustion.

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.

IBM Sterling Partner Engagement Manager Essentials Edition 6.3.0.0 through 6.3.0.2, and 6.2.4.0 through 6.2.4.4, and IBM Sterling Partner Engagement Manager Standard Edition 6.2.4.0 through 6.2.4.4 could allow an unauthenticated user to cause a denial of service in the email service due to improper control of interaction frequency.

IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security.

A vulnerability in the vm2 library (npm) versions up to 3.12.0 allows sandbox escape in VM and NodeVM. When an embedder exposes a host API returning a host-realm Promise, the rejection sanitizer does not cover all cases, and sandboxed code can overwrite Promise properties to obtain an unsanitized host object. This can lead to arbitrary code execution on the host. Fixed in 3.12.1.

A vulnerability in NodeVM of vm2 before 3.12.1 allows sandbox escape because the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary commands on the host when NodeVM is configured with builtin:['*'] or explicit child_process allowance.

vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM. The sanitizer leaves crypto.setFips callable, allowing guest code to change the FIPS mode of the entire host process, crossing the NodeVM isolation boundary. Fixed in vm2 3.12.1.

A vulnerability in vm2 through 3.12.0 (fixed in 3.12.1) involves incorrect handling of a nullish `this` receiver in the apply trap of its bridge. When sandboxed code calls a host-provided non-strict function without a receiver, the undefined receiver is passed through, and V8 substitutes the host realm's global object. vm2 returns that object to the sandbox, allowing a complete sandbox escape and access to process. Exploitation requires the embedding application to expose at least one non-strict host function.

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints.

rustls-webpki versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accept permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com is treated as satisfied by a certificate for *.example.com, which could assert reject.example.com outside the permitted subtree.

rustls-webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, accepting rather than enforcing them. These constraints apply to otherwise properly issued certificates, so the flaw is reachable after successful signature verification and requires a misissued certificate.

rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING with content exactly [0x00], causing an underflow and panic. Reachable via BorrowedCertRevocationList::from_der() when a CRL contains an issuingDistributionPoint extension with such an onlySomeReasons value. Requires an application that opts in to CRL revocation checking and parses attacker-influenced CRL bytes; default rustls configuration is unaffected. Fixed in 0.103.13 and 0.104.0-alpha.7.

ArcadeDB (com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: HostClassLookupFilter.DENIED lists java.util.ResourceBundle as a bare class name, not covering subclasses, while ScriptTriggerExecutor.ALLOWED_PACKAGES permits java.util.*. A user with UPDATE_SCHEMA privilege can reference java.util.PropertyResourceBundle or java.util.ListResourceBundle and invoke ResourceBundle.getBundle(String) to read .properties resources from the application classpath, disclosing sensitive configuration data. Fixed in 26.9.1.