CVE Vulnerability Catalog

RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size caller buffer without an upper bound check. When an OLE paste consumer such as explorer.exe calls IStream::Read with a buffer of cb bytes, CliprdrStream_Read in libs/clipboard/src/windows/wf_cliprdr.c requests that many bytes of a remote file through cliprdr_send_request_filecontents and then executes CopyMemory(pv, clipboard->req_fdata, clipboard->req_fsize), where req_fsize is taken verbatim from the peer's CLIPRDR FileContentsResponse by wf_cliprdr_server_file_contents_response (req_fsize = fileContentsResponse->cbRequested) and is never clamped to cb anywhere in the chain. The function's only length comparison, req_fsize < cb, handles the short-read case and is evaluated after the copy has already occurred. A malicious or compromised peer that answers a small file-contents read with an oversized response therefore writes attacker-chosen data past the end of the paste consumer's heap buffer when the local user pastes clipboard file contents offered by the remote side.

phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an entry written during an app_id lookup to satisfy a subsequent app_code lookup, allowing attackers to use the numeric database row identifier as an API token to read, write, and delete all IP address management records.

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context.

An authentication bypass issue exists in communications between affected versions of the Zscaler Client Connector and the Zscaler Client Connector Portal.

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/{id} setting company_id in the body.

Unauthenticated PHP Object Injection in FreightCo versions up to 1.1.15. An attacker can send crafted data to execute arbitrary code.

Unauthenticated Privilege Escalation in Jawn versions up to 1.4.2. An attacker can gain elevated privileges without authentication.

Unauthenticated Local File Inclusion in WP Cafe Pro versions before 3.0.15. An attacker can read arbitrary files from the server.

Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress versions up to 8.9.1. An attacker can gain elevated privileges without authentication.

The Woo Essential plugin for WordPress (up to version 4.3.0) contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. An attacker can inject arbitrary SQL statements.

Unauthenticated Privilege Escalation in Digits versions up to 9.2. An attacker can gain elevated privileges without authentication.

A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates the path against a confined os.Root directory handle but subsequently opens and creates the file using os.Create with an unconfined string path. This discrepancy between path resolution checks and file creation allows an attacker to escape directory confinement, overwrite root-owned host files, and achieve host root code execution.

Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the loadStyles method of the frontend page model.

The 4MOSAn GCB Doctor product by 4MOSAn Security Technology has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject malicious commands through an unremoved ADOdb test page parameter, thereby executing arbitrary system commands on the server.

A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. It affects the strcpy function in the file /goform/aspRemoteApConfTempSend of the HTTP Request Handler component. Manipulating the Profile argument results in a stack-based buffer overflow. The attack can be carried out remotely, and the exploit is public.

A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. It affects the httpcon_check_session_url function of the Session Validation Handler component. This manipulation leads to improper authentication. The attack can be executed remotely, and the exploit is public. The vendor did not respond.

A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the httpcon_check_session_url function of the Session Validation Handler component. This manipulation causes improper authentication. Remote exploitation is possible, and the exploit is public. The vendor did not respond.

The exceljs library through version 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious __proto__ property to cell notes, modifying Object.prototype and affecting all plain objects created in the process.

A vulnerability in DBD::Pg version 3.21.0 for Perl: heap out-of-bounds write in quote_float. quote_float() allocates the length of the string + 1, but for special literals (NaN, Inf, +Inf, -Inf, Infinity, +Infinity, -Infinity) it emits the literal surrounded by quotes plus NULL, causing an overflow of 2 bytes. This can be reached by the $dbh->quote method, e.g., $dbh->quote("Infinity", DBI::SQL_NUMERIC). This regression was introduced in 3.21.0 by the quote.c rewrite.

justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting to Markdown. Characters like < and > are preserved, allowing raw HTML injection into Markdown output, bypassing sanitization and potentially leading to XSS.