CVE Vulnerability Catalog

sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields to overflow stack buffers and cause crashes or execute arbitrary code during packet parsing and rendering.

Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sg_load_player_unit() when processing savegame files with invalid unit activity indices. An attacker can craft a malicious savegame file with an out-of-range activity index that bypasses bounds checking and causes a crash or limited heap memory exposure when loaded.

Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load() when processing savegame files with declared worklist lengths exceeding the fixed array bound of 64 elements. Attackers can craft malicious savegame files that write past the entries array into adjacent heap-allocated struct fields, potentially corrupting memory when a user or server operator loads the file.

vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants.

vLLM versions >=0.10.2 and <0.28.0 do not apply any audio decode-size or duration limit when extracting audio from video input for NanoNemotronVL models. In nano_nemotron_vl.py, _extract_audio_from_videos calls load_audio_pyav(BytesIO(video_bytes)) without the max_duration_s or max_decode_bytes parameters, so neither VLLM_MAX_AUDIO_DECODE_DURATION_S nor VLLM_MAX_AUDIO_DECODE_BYTES is enforced (unlike the direct audio upload path in AudioMediaIO). When a NanoNemotronVL model is served with use_audio_in_video=True, an attacker who supplies a small, highly compressed video as multimodal input can force the server to allocate gigabytes of memory during audio decoding, resulting in a denial of service. Fixed in vLLM 0.28.0.

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processing_llava_onevision2.py that executes with vLLM process authority even when trust_remote_code is set to False.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the Playlists_schedules/list.json.php and Live/calendar.json.php endpoints, allowing authenticated and unauthenticated users to read private playlist schedule metadata. Attackers with canStream privileges or no authentication can retrieve schedule names, descriptions, timestamps, and playlist identifiers by querying these endpoints without ownership checks.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the video_from_program API endpoint, allowing unauthenticated access to private playlist contents. Attackers can query the API without authentication to enumerate private playlist names, owner information, and video titles including password-protected content.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to check user authorization in the PlayerSkins mediaSession.json.php endpoint before returning video metadata. Unauthenticated attackers can request the endpoint with a video ID parameter to retrieve password-protected video titles and owner email addresses without authentication.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to properly authorize access to the videosAndroid.json.php endpoint, allowing unauthenticated guests to list password-protected videos with sensitive owner information. Attackers can retrieve video metadata including owner email, lastLogin, filename, and hashId by sending an unauthenticated GET request to the endpoint.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the ImageGallery list.json.php endpoint, allowing unauthenticated access to list gallery files. Attackers can retrieve filenames and URLs of password-protected image galleries by directly accessing the endpoint, then fetch the exposed files without authentication.

The Bookmark plugin in WWBN AVideo fails to validate user permissions in the getBookmarks.json.php endpoint. Unauthenticated attackers can read chapter names from password-protected videos by supplying a video ID parameter.

The like.json.php endpoint in WWBN AVideo fails to validate video access permissions. Logged-in users can record likes on password-protected and group-restricted videos, incrementing like counters without being able to watch the content.

The commentAddNew.json.php endpoint in WWBN AVideo fails to validate video access permissions. Authenticated users can post comments on password-protected and group-restricted videos, bypassing password and group access controls.

The videoAddViewCount.json.php endpoint in WWBN AVideo fails to validate video access permissions before updating view statistics. Authenticated attackers can increment view counts and watch-time on videos they cannot access by submitting arbitrary video IDs.

The Live plugin in WWBN AVideo contains a missing authentication vulnerability in plugin/Live/socketMessageLiveOwner.json.php. An unauthenticated attacker who knows an administrator's Live stream key can deliver arbitrary in-app notification messages to that administrator, with no login check or CSRF token.

The remindMe.json.php endpoint in WWBN AVideo fails to validate that logged-in users can access live schedules before creating reminders. Authenticated attackers can create reminders for private live schedules they cannot view and learn the private schedule title from the generated email job.

The plugin/TopMenu/menus.json.php endpoint in WWBN AVideo does not require authentication. Unauthenticated attackers can retrieve all menu data, including inactive and admin-only menu names not displayed in the public navbar.

The playListAddVideo.json.php endpoint in WWBN AVideo fails to validate watch permissions when adding videos to playlists. Authenticated attackers can add password-protected videos they cannot watch to playlists they own by submitting video ID and playlist ID parameters.

The plugin/TopMenu/menuItems.json.php endpoint in WWBN AVideo contains a missing authentication vulnerability. Unauthenticated attackers can read inactive admin menu items by submitting a POST request with a menuId parameter, including hidden menu item URLs with embedded admin-tool secret query parameters not exposed in the public navbar.