CVE Vulnerability Catalog

PocketMine-MP before versions 3.26.5 and 4.0.5 fails to validate the length of skin data fields submitted by players, allowing values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized fields like skinID or geometryName to trigger exceptions during NBT serialization, causing server crashes.

PocketMine-MP 3.x (before 3.27.0) does not implement Minecraft Bedrock protocol encryption, so the server cannot verify that a connecting client possesses the private key corresponding to its login token. An attacker who captures a valid login from another player's session (for example by tricking the player into connecting to an attacker-controlled server) can replay that login to impersonate the victim and pass XBOX Live authentication until the JWT token expires (typically 2-3 days). This affects servers directly reachable over the internet that are not behind a proxy with encryption enabled. Fixed in 4.0.0 and backported to 3.27.0.

PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket (for START_BREAK and CRACK_BREAK actions) or in UseItemTransactionData (typically within InventoryTransactionPacket). A remote authenticated attacker can send crafted packets with invalid facing values (e.g., negative or out-of-range) to crash the server, resulting in a denial of service.

PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JSON from clients. Attackers can send specially crafted form response packets with invalid JSON to trigger an uncaught InvalidArgumentException, causing server crashes.

PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes.

PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from clients. Attackers can send crafted inventory transactions with malformed NBT tags to trigger server crashes and cause denial of service.

PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by newline characters, allowing attackers to send large messages containing many newlines. Malicious clients can send megabyte-sized chat packets and bombard the server with thousands of such messages, causing server lockups lasting seconds or minutes.

PocketMine-MP before version 4.4.2 fails to properly validate item IDs received from clients in itemstack NBT data. Attackers can send crafted item IDs outside the valid range to trigger an uncaught exception that crashes the server.

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via checkSecurity()/isTrustedType(). However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes, meaning all classes are deserializable by default.

In the Hospital Information System 1.0 from code-projects, in the file /HIS/src/patients/editPatient.php within the Patient Management component, manipulation of the argument ID leads to cross-site scripting (XSS). The attack can be launched remotely, and the exploit has been publicly disclosed.

A flaw has been found in Tenda AC9 15.03.05.14. This impacts the function R7WebsSecurityHandler of the component Web Management. This manipulation causes improper authentication. The attack may be initiated remotely. The exploit has been published and may be used.

A vulnerability was detected in Linksys RE7000 2.0.15. It affects the function platform_event_pingTest of the file /cgi-bin/json.cgi?PingTest in the PingTest Handler component. Manipulation of the arguments pingTestIp/pingTestPktSize/pingTestTimes results in OS command injection. The attack can be launched remotely. The exploit is now public and may be used.

Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and note data, and arbitrary invocation of native device APIs.

The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'content_process_images' function using a flawed regex-based HTML attribute parser. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

In MISP up to version 2.5.45, the validation of the user-configurable homepage only checks if the path starts with '/', which is insufficient. Protocol-relative URLs like '//attacker.example' also start with '/' but resolve to an external origin in browsers. The vulnerable homepage value can be stored and used in post-login routing.

A vulnerability was discovered in SourceCodester Class and Exam Timetabling System 1.0 in an unknown function of the file /delete_subject.php. Manipulation of the argument ID results in SQL injection. The attack can be initiated remotely and the exploit has been publicly released.

A vulnerability was identified in D-Link DIR-605 B1v202WWB03 in the tunnel_set_params function of the file progs.gpl/pppd.alpha/l2tp/tunnel.c in the L2TP Control Message Parser component. Manipulation of the argument peer_hostname leads to an off-by-one error. The attack may be performed remotely but is highly complex and difficult to exploit. The exploit is publicly available.

A vulnerability was found in D-Link DIR-822A A_101 in the strcpy function of the file udhcpcd/serverpacket.c in the udhcpcd component. This manipulation causes a stack-based buffer overflow. The attack can be carried out remotely and the exploit is publicly disclosed.

A vulnerability was found in D-Link DIR-895L A1_102b07 in the sendACK function of the file udhcpcd/serverpacket.c in the udhcpcd component. Manipulation of the argument Hostname results in command injection. The attack can be executed remotely and the exploit has been made public.

In SourceCodester Simple Traffic Offense System 1.0, a vulnerability was found in the file save-settings.php of the Settings Update Endpoint component. Manipulation of the site_name/site_desc arguments leads to cross-site scripting. Remote exploitation is possible, and the exploit has been disclosed.