CVE Vulnerability Catalog

PluginScript attempts to chroot the plugin to the repoManagerRoot, which is often / (the system root) in standard configurations. If the chroot target is /, it is a no-op, allowing the traversed path to execute host binaries (like /bin/bash) with root privileges.

NLnet Labs Unbound up to version 1.25.0 inclusive contains a denial of service vulnerability in the DNSSEC validator that can lead to a crash given malicious upstream replies. The issue stems from using the wrong counter to calculate write offsets for ADDITIONAL section rrsets. An attacker controlling a DNSSEC-signed domain can trigger a crash with a single query.

A vulnerability in Unbound (versions 1.14.0 through 1.25.0) causes a heap overflow when encoding multiple NSID, DNS Cookie, and EDNS Padding options in the reply packet. A flaw in the EDNS field size calculation leads to out-of-bounds write.

NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they are parsing and creating internal data structures for the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1 contains a patch limiting acceptable incoming EDNS options to 100.

In the `socket_handler` function in `src/havegecmd.c` of haveged, the credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`) is incomplete. Although it detects that the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), the code **fails to stop execution** and proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.

Unbound versions 1.16.2 through 1.25.0 are vulnerable to a 'ghost domain names' attack that can extend the ghost domain window by one TTL value. The attacker needs control over a ghost zone and the ability to query a vulnerable Unbound. A fix is available in version 1.25.1.

The AcyMailing WordPress plugin up to version 10.8.2 does not properly verify user permissions, allowing authenticated attackers with subscriber-level access to modify configuration, export subscriber secret keys, and take over administrator accounts.

Memcached before version 1.6.42 uses the memcmp function for password comparison in SASL authentication, causing a timing side-channel vulnerability. An attacker can read passwords by measuring response times.

In memcached before version 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.

A broken access control issue in Talend Administration Center allows a user with 'View' permission to modify the Talend Studio update URL. This issue has been resolved in an available patch.

The Advanced Database Cleaner – Premium plugin for WordPress versions up to and including 4.1.0 contains a Local File Inclusion (LFI) vulnerability via the 'template' parameter. Authenticated attackers with Subscriber-level access or higher can include and execute arbitrary .php files on the server.

The Boost plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_url' and 'user_name' parameters in versions up to 2.0.3. Insufficient escaping and lack of prepared statements allow unauthenticated attackers to append malicious SQL queries, potentially extracting sensitive database information.

E-LAN Hybrid Recording System by TONNET has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.

A stored cross-site scripting vulnerability was discovered in the administrator Queue Manager of mailcow-dockerized. The Queue Manager fetches mail queue entries from /api/v1/get/mailq/all, copies server-controlled Postfix queue fields into DataTables rows, and renders several of those fields as HTML without adequate output encoding.

NVIDIA Triton Inference Server contains a vulnerability in the DALI backend that allows an attacker to cause an integer overflow. Successful exploitation could lead to code execution, data tampering, or denial of service.

NVIDIA Triton Inference Server contains a vulnerability in the DALI backend that allows an attacker to cause an out-of-bounds read. Successful exploitation could lead to code execution, data tampering, denial of service, or information disclosure.

NVIDIA Triton Inference Server contains an integer overflow vulnerability that an attacker could exploit to cause denial of service.

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path traversal issue. A successful exploit of this vulnerability might lead to denial of service.

NVIDIA Triton Inference Server contains a vulnerability that allows an attacker to bypass authentication. Successful exploitation could lead to privilege escalation, denial of service, or information disclosure.

NVIDIA TRT-LLM contains a vulnerability in RPC testing that allows unsafe deserialization, potentially leading to code execution, denial of service, data tampering, and information disclosure.