CVE Vulnerability Catalog

An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the src/media_tools/dvb_mpe.c, descriptorTime_slice_fec_identifier() and gf_m2ts_ipdatagram_reader() components. Fixed in 0e4093392e1f847c90d20e031e893cd942fef938.

Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the j2kdec_process() function. Fixed in 9a253a07fd3f6b48022bba74302bf39388dda859.

Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the nhntdmx_process() function. Fixed in fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6.

In Cyrus IMAP before 3.12.4, there is a double-free vulnerability in the VPATCH BYPARAM mechanism. An authenticated calendar user can crash a CalDAV worker by sending a PATCH request with PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector is freed multiple times during iteration over properties.

In Cyrus IMAP before 3.12.4, there is a Sieve mailbox existence oracle. An authenticated user can install a Sieve script that probes whether another user's private mailbox exists, or reads the value of shared mailbox annotations, by observing which fileinto branch fires during LMTP delivery.

In Cyrus IMAP before 3.12.4, Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to perform the archived, snoozed, or other role, which might cause mail to be written to the shared mailbox, sharing more content than intended.

In Cyrus IMAP before 3.12.4, CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.

In Cyrus IMAP before 3.12.4, a JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H<emailid>-<index>, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.

A use-after-free in the SocketDescriptor::tcpReadHandler1 function (liveMedia/RTPInterface.cpp) of LIVE555 Streaming Media (version 2026.02.26) allows attackers to cause a Denial of Service (DoS) via sending a series of crafted RTSP and HTTP requests to the server.

Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql.

SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 through 4.3.2 allows remote unauthenticated attackers to execute arbitrary SQL commands and read arbitrary database contents via the id parameter to /mpblog/post/view.

In Cyrus IMAP before 3.12.4, JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user, despite having no insert permissions to the target mailbox.

SkillTree before version 4.4.2 contains an XSS vulnerability resulting from a combination of two flaws: lack of HTML encoding in StringHighlighter.js and use of v-html in HighlightedValue.vue. An attacker can register an account with malicious firstName/lastName/nickname fields, and when an administrator opens the Quiz Runs page, the payload executes in their browser. There are three attack paths with escalating impact: basic XSS, remote script loading via import(), and CSRF token theft.

An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the inetd service spawns /app/sh_for_telnet.

In WIngs3D v.2.4.1, there is an issue that allows a local attacker to cause a denial of service via a crafted Wavefront OBJ file.

In the Thesycon DPC Latency Checker driver (dpc.sys) through 1.4.0, there is a vulnerability that allows local unprivileged users to cause a denial-of-service (BSOD) on Windows systems. The driver exposes an IOCTL interface (0x81772008) that accepts user-controlled input without validating pointers before passing them to kernel APIs. Specifically, it dereferences a user-supplied pointer and uses the resulting value in a call to ExSetTimerResolution, leading to arbitrary kernel memory access and system crash.

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters.

MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve code execution if gadget classes exist.

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious ci_session cookie with administrator privileges by computing an HMAC-SHA1 using the publicly known encryption key, bypassing authentication checks in is_login() and mso_check_allow() functions.

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the admin_page upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/_pages/ directory, which executes in visitors' browsers when accessed, enabling persistent stored XSS attacks.