CVE Vulnerability Catalog

In nr modem, there is a possible improper input validation, which could lead to remote denial of service with no additional execution privileges needed.

In the Modem IMS module, a possible improper input validation vulnerability was found. This could lead to a remote denial of service (DoS) attack.

In the Modem IMS module, a possible improper input validation vulnerability has been found. This could lead to remote denial of service without requiring additional execution privileges.

In Modem IMS, there is a possible improper input validation, which could lead to remote denial of service.

In the Modem IMS module, a possible improper input validation vulnerability has been found. This could lead to remote denial of service without requiring additional execution privileges.

In IMS, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed.

Jupyter Server versions 2.17.0 and earlier use re.match() for Origin header validation, allowing bypass of CORS restrictions. An attacker controlling a domain like trusted.example.com.evil.com can make cross-origin requests to the server API.

OpenMRS Core up to version 2.7.8 and versions 2.8.0-2.8.5 contain a path traversal vulnerability in the `/openmrs/moduleResources/{moduleid}` endpoint. The getFile() function does not validate the path, allowing an unauthenticated attacker to read arbitrary files, including /etc/passwd and configuration files with database credentials. Exploitation is only possible on Apache Tomcat versions prior to 8.5.31.

In versions 2.1.63 through 2.1.83 of Claude Code, the folder trust determination logic used the git worktree commondir file without validating its contents. An attacker could craft a malicious repository with a commondir file pointing to a path the victim had previously trusted, causing Claude Code to bypass its trust confirmation dialog and immediately execute hooks defined in `.claude/settings.json`. Exploitation requires the victim to clone the malicious repository and run Claude Code within it, and the attacker must know or guess a path the victim had already trusted. This issue has been fixed in version 2.1.84.

Quarkus before versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2 has a path normalization inconsistency between the security layer and routing. An attacker can bypass authorization policies by appending a semicolon and arbitrary text to the URL (e.g., /api/admin;anything).

In Pi-hole FTL before version 6.6.1, the `dns.interface` configuration field accepts newline characters without validation, allowing an attacker to inject directives into the dnsmasq config file. On installations without an admin password, a network-adjacent attacker can enable the built-in DHCP server and achieve remote code execution on the next DHCP lease request. Fixed in version 6.6.1.

Gotenberg version 8.29.1 has a blind SSRF vulnerability. An unauthenticated attacker with network access can force the server to make outbound HTTP POST requests to arbitrary internal or external destinations by supplying a crafted URL in the Gotenberg-Webhook-Url header.

A buffer overflow vulnerability in D-Link DI-8100 version 16.07.26A1 in the file /user_group.asp (CGI Handler) via the sprintf function allows remote exploitation. The exploit has been publicly disclosed.

A buffer overflow vulnerability in D-Link DI-8100 version 16.07.26A1 in the web management interface (file /url_member.asp) allows remote exploitation via the Name argument. An exploit has been published.

In ProFTPD up to version 1.3.9a before commit 7666224, a SQL injection vulnerability exists in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c. When UseReverseDNS is enabled, an attacker can supply a crafted domain name that is passed unsanitized into SQL queries, allowing remote injection of arbitrary SQL commands.

Gotenberg versions 8.30.1 and earlier use the regular expression ^https?:// to check URLs in private IP deny-lists. Since Go normalizes the URL scheme to lowercase before establishing a connection, an attacker can bypass the block by using uppercase letters in the scheme (e.g., HTTP://). This allows unauthenticated requests to internal network services, including cloud metadata endpoints.

Jupyter Server versions 2.17.0 and earlier contain a path traversal vulnerability in the REST API that allows an authenticated user to escape the configured root_dir and access sibling directories whose names begin with the same prefix as the root_dir. An attacker can read, write, and delete files in affected sibling directories. Multi-tenant deployments with predictable naming schemes are particularly at risk. Version 2.18.0 contains a fix.

In Sandboxie-Plus versions 1.17.2 and earlier, a TOCTOU race condition exists during addon installation. After UpdUtil.exe verifies file hashes, an unprivileged user can replace files.cab with a crafted cabinet containing a malicious executable, which is then run as SYSTEM.

In Sandboxie-Plus 1.17.2 and earlier, the NamedPipeServer::OpenHandler has a stack buffer overflow due to wcscat without null termination check. A sandboxed attacker can escape and achieve code execution as SYSTEM.

In Sandboxie-Plus 1.17.2 and earlier, ProcessServer handlers have stack buffer overflows due to wcscpy without null termination check. A local attacker can achieve code execution as SYSTEM.