CVE Vulnerability Catalog

In SQLBot prior to 1.9.0, the POST /api/v1/datasource/parseExcel endpoint uses attacker-controlled multipart filename data to select where uploaded content is stored, writes content before validation completes, and can transform a double-extension filename into a Python source file. The file lands in alembic/versions/ and is imported on SQLBot startup.

JabRef, a desktop application for managing BibTeX/BibLaTeX libraries, prior to 6.0-alpha.6 is vulnerable to shell command injection. When the built-in HTTP server (jabsrv) is enabled, the GET /better-bibtex/cayw endpoint accepts an external command query parameter, which on Unix-like systems is combined with citation keys and executed through sh -c without shell escaping.

OpenImageIO before versions 3.0.16.0 and 3.1.11.0 contains a vulnerability in BMP handling. Processing a crafted BMP file through oiiotool or an application linked to OpenImageIO can reach BMP palette handling in src/bmp.imageio/bmpinput.cpp with an empty color table. BmpInput::read_native_scanline then performs an invalid palette read while decoding an RLE-compressed scanline, causing a process crash and denial of service. This issue is fixed in versions 3.0.16.0 and 3.1.11.0.

yutu, an AI-powered toolkit for managing YouTube channels, prior to 0.10.9 allows writing files outside the permitted directory. The caption-download MCP tool accepts a caller-controlled file parameter that is passed to os.Create() without using the pkg.Root confinement boundary backed by YUTU_ROOT, enabling overwrite of any file writable by the process.

The Motors – Car Dealership & Classified Listings Plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvl_ajax_dealer_load_cars() function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to retrieve draft, pending, private, and future car listings belonging to arbitrary users.

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. This is due to the plugin accepting a client-supplied package-redemption identifier as proof of payment without validating it. This makes it possible for unauthenticated attackers to create approved appointment bookings without completing payment.

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing ownership verification on /users/customers/<id> endpoint in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with wpamelia-provider role, to view and modify arbitrary customers, including password reset. Takeover of WordPress user accounts, with the roles up to Editor, is also possible if that user had made an Amelia booking. This vulnerability affects only the Premium version of the plugin, where the Employee Panel is present.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical details about the vulnerability are available.

A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 (the minimum valid BSON document size) before using it in an array index calculation. When the length field is zero, the expression used to check the document's null terminator wraps to UINT32_MAX, causing a heap out-of-bounds read that crashes the process. An unauthorized party who can supply crafted BSON input to an application using this API can cause a denial of service.

A flaw in libmongoc's SCRAM authentication implementation causes the client to continue the handshake and transmit the client proof even when a nonce mismatch is detected in the server's first message. A man-in-the-middle attacker can inject a crafted server-first-message with a controlled salt and low iteration count, then capture the client proof for offline password cracking. The vulnerability is mitigated by TLS, which is standard in production deployments.

A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap allocation while processing incoming encrypted traffic after the TLS handshake completes. No authentication or user interaction is required, because the affected processing occurs before any application-level authentication completes. Triggering this issue may lead to memory corruption in the client process, disclosure of adjacent heap memory, or termination of the process.

Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. The vulnerability was rated High severity by Chromium.

UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. The vulnerability was rated Low severity by Chromium.

Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain sensitive information via a crafted HTML page. The vulnerability was rated Medium severity by Chromium.

Server-side request forgery in Omnibox in Google Chrome on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. The vulnerability was rated Medium severity by Chromium.

Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability was rated Medium severity by Chromium.

Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability was rated High severity by Chromium.

Buffer overflow in PDFium in Google Chrome on Windows prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted PDF file. The vulnerability was rated High severity by Chromium.

Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. The vulnerability was rated Medium severity by Chromium.

Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)