CVE Vulnerability Catalog

Luanti 5 przed wersją 5.15.2 czasami umożliwia niezamierzony dostęp do niezabezpieczonego środowiska. Jeśli przynajmniej jeden mod jest wymieniony jako secure.trusted_mods lub secure.http_mods, to stworzony mod może przechwycić żądanie do niezabezpieczonego środowiska lub API HTTP oraz uzyskać do niego dostęp.

OpenHarness prior to commit dd1d235 contains a command injection vulnerability that allows remote gateway users with chat access to invoke sensitive administrative commands by exploiting insufficient distinction between local-only and remote-safe commands in the gateway handler. Attackers can execute administrative commands such as /permissions full_auto through remote chat sessions to change permission modes of a running OpenHarness instance without operator authorization.

The vulnerability in TP-Link Archer C7 v5 and v5.8 (uhttpd modules) related to inadequate encryption strength allows for password recovery exploitation. The web interface encrypts the admin password client-side using RSA-1024 before sending it to the router during login.

Free5GC to projekt open-source dla sieci rdzeniowych 5G. W wersjach 4.2.1 i niższych występuje podatność na ujawnienie informacji w usłudze UDR, która pozwala na uzyskanie identyfikatorów subskrybentów przez nieautoryzowanych atakujących.

maddy (a composable, all-in-one mail server) versions prior to 0.9.3 contain an LDAP injection vulnerability in the auth.ldap module. User-supplied usernames are interpolated into LDAP search filters and DN strings via strings.ReplaceAll() without any LDAP filter escaping, despite the availability of ldap.EscapeFilter(). An attacker with network access to the SMTP submission or IMAP interface can inject arbitrary LDAP filter expressions through the username field in AUTH PLAIN or LOGIN commands, enabling identity spoofing, LDAP directory enumeration, and blind extraction of LDAP attribute values.

OWASP BLT versions prior to 2.1.1 contain an RCE vulnerability in the .github/workflows/regenerate-migrations.yml workflow. The workflow uses the pull_request_target trigger with full GITHUB_TOKEN write permissions, copies attacker-controlled files from untrusted pull requests, and executes python manage.py makemigrations, which imports a malicious models.py and executes arbitrary code.

Pillow versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation).

Composer versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase() and Perforce::generateP4Command() methods. An attacker can inject arbitrary commands through crafted source reference or source url values containing shell metacharacters, even if Perforce is not installed.

Command injection vulnerability in the Perforce::generateP4Command() method in Composer, a dependency manager for PHP. An attacker can inject arbitrary commands through Perforce connection parameters (port, user, client) in a malicious composer.json, leading to command execution in the context of the user running Composer.

Wersje Barracuda RMM przed 2025.2.2 zawierają podatność na eskalację uprawnień, która pozwala lokalnym atakującym uzyskać uprawnienia na poziomie SYSTEM, wykorzystując zbyt liberalne ACL systemu plików w katalogu C:\Windows\Automation. Atakujący mogą modyfikować istniejące treści automatyzacji lub umieszczać kontrolowane przez siebie pliki w tym katalogu, które są następnie wykonywane pod kontem NT AUTHORITY\SYSTEM podczas rutynowych cykli automatyzacji.

A buffer overflow vulnerability was found in GIMP's `ReadJeffsImage` function when loading GIF files. Processing a specially crafted GIF file can cause a write beyond the allocated buffer.

Type Confusion in V8 in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

Heap buffer overflow in PDFium in Google Chrome on Windows prior to version 147.0.7727.101 allows a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted PDF file.

Use after free in FileSystem in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page.

W Google Chrome na systemie Windows przed wersją 147.0.7727.101 wystąpiła podatność typu use after free w module wideo, która pozwalała zdalnemu atakującemu, który przejął proces renderowania, na dostęp do pamięci poza przydzielonym zakresem za pomocą spreparowanej strony HTML.

A use after free vulnerability in XR in Google Chrome on Android prior to version 147.0.7727.101 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

A use after free vulnerability in Payments in Google Chrome on Android prior to version 147.0.7727.101 allowed a remote attacker to execute arbitrary code by convincing a user to perform specific UI gestures on a crafted HTML page.

Use after free in Codecs in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

In Google Chrome prior to version 147.0.7727.101, there was a use after free vulnerability in the Cast component that allowed a remote attacker to execute arbitrary code via a crafted HTML page.

A use after free vulnerability in Forms in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.