CVE Vulnerability Catalog

The stbsp_vsnprintf function in nothings stb (commit 31c1ad3) has an out-of-bounds read that can be exploited via crafted input, causing a denial of service.

The stbtt_GetGlyphShape component in nothings stb (commit 31c1ad3) has an out-of-bounds read that can be exploited via a crafted TTF file, causing a denial of service.

The gf_dm_data_received function in GPAC version 26.07.0 has an out-of-bounds read that can be exploited via a crafted HTTP request, causing a denial of service. The vulnerability is fixed in a specific commit.

The gf_dash_get_timeline_duration function in GPAC version 26.07.0 has a divide-by-zero vulnerability that can be exploited via a crafted MPD SegmentTimeline, causing a denial of service. The vulnerability is fixed in a specific commit.

SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields (including passwords and roles) via crafted parameters to the User/mod interface, enabling account takeover.

A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the ${} string concatenation in AdminMapper.java and multiple other Mapper files (including MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.java).

money-pos 1.0 contains a stored Cross-Site Scripting (XSS) vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly concatenating it into the order log description; the frontend subsequently renders this content using v-html. An attacker with product creation privileges can inject a malicious JavaScript payload, causing unauthorized code execution when an administrator views the order logs.

A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's `html().text()` method and subsequently injects the result into the DOM. An administrator or attacker capable of controlling the announcement content can exploit this vulnerability to execute arbitrary JavaScript code in the browsers of users viewing the affected pages, which may include the dashboard, activity feed, or login page, depending on the announcement's visibility settings.

An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file, which is not overridden or removed in the production environment profile. A remote, unauthenticated attacker can locally forge valid administrative session tokens to completely bypass the authentication mechanism gaining full unauthorized access to protected backend APIs.

The rattler_cache (before 0.9.0) and py-rattler (before 0.24.0) libraries are vulnerable to package-cache path traversal when handling package metadata from conda channels. A malicious channel can publish repodata with path separators in the build field, causing files to be written outside the cache directory.

In alf.io before version 2.0-M5-2605, an improper access control issue allows an organization owner to read system-level configuration secrets through organization/event scoped 'single configuration' endpoints, including the system API key.

An issue in Actions Semiconductor Co. Ltd Tool - Media Player Utilities v.4.46 allows a physically proximate attacker to execute arbitrary code via the Production.dll and RdiskUpgrade.exe components.

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... TO PROGRAM statement into content that is processed when an authenticated user interacts with the MCP server in its default read-only mode.

Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address and erase all stored addresses by iterating the address id via a GET request to /customer/address/delete/id/{id}.

The web-based management interface in CPPM guest account management services contains a vulnerability that allows an unauthenticated remote attacker to manipulate account settings. Successful exploitation could allow an attacker to extend network access beyond policy limits.

The ClearPass OnGuard agent contains a vulnerability that allows an authenticated remote attacker to elevate their own privileges on a vulnerable deployment. Successful exploitation could allow an attacker to obtain root privileges.

A vulnerability in the CPPM web interface could allow an authenticated remote attacker to access directory information on a vulnerable system, and successful exploitation could allow arbitrary command execution on the underlying operating system.

A vulnerability in the web-based management interface of CPPM could allow an unauthenticated remote attacker to conduct a Denial-of-Service (DoS) attack, causing instability and performance degradation of the vulnerable CPPM server.

A vulnerability in the web-based management interface of vulnerable CPPM systems could allow an authenticated remote attacker to achieve remote code execution, allowing arbitrary command execution on the underlying operating system.

An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to cause a denial of service via the function gf_route_media_complete_object(). Fixed in 3c4e6c5b3e0c6fa9b16d55599701a08354538fab.