CVE Vulnerability Catalog

A Server-Side Request Forgery (SSRF) vulnerability in IBM ContextForge MCP Gateway versions 0.1.0 through 1.0.5. An authenticated user with gateway creation privileges can perform arbitrary HTTP POST requests to internal network resources and cloud metadata endpoints by supplying a malicious oauth_config.token_url parameter during OAuth-enabled gateway registration.

A security vulnerability was detected in H3C Magic NX15 NX15V100R017 affecting the sub_416874 function in /usr/bin/usrlist. Manipulation leads to a stack-based buffer overflow, and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.

A vulnerability in the Bluetooth Classic Hands-Free Profile HF role (hfp_hf.c) causes AT command buffers still queued on hf->tx_pending to be leaked when the RFCOMM DLC goes down, permanently draining the fixed hf_pool. Additionally, hfp_hf_disconnected() leaves BT_HFP_HF_FLAG_CONNECTED set, and hfp_hf_create() may memset() the object while work items are still pending or running, corrupting shared kernel workqueue state. A remote Audio Gateway peer can exhaust the buffer pool and stall the Bluetooth RX thread.

A vulnerability in the Zephyr RTOS syscall verifier: z_vrfy_rtio_cqe_get_mempool_buffer() validated its output parameters buff and buff_len with K_SYSCALL_MEMORY_READ() instead of K_SYSCALL_MEMORY_WRITE(). This allows an unprivileged user-mode thread to invoke the syscall with pointers to read-only memory, causing a supervisor-mode store outside the permitted region or a kernel fault that halts or reboots the device.

IBM Storage TS4500 Library versions 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to gain unauthorized administrative privileges due to a race condition.

The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list was incomplete and omitted 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, and fe80::/10, as well as IPv4-mapped IPv6 forms, allowing an authenticated user to direct requests to internal addresses from the MISP server's network context.

A weakness has been identified in H3C Magic NX15 V100R017 affecting the importprofile function in the /api/upload file. Manipulation of the fileName argument causes path traversal, the attack can be initiated remotely, and the exploit has been made publicly available.

IBM Storage TS4500 Library and IBM TS4500 Tape Library/Diamondback Tape Library versions 1.1.1.6 through 1.12.0.3 do not invalidate sessions, which could allow an authenticated user to impersonate another user on the system.

IBM Storage TS4500 Library versions 1.1.1.6 through 1.12.0.3 does not invalidate the session after logout, which could allow an authenticated user to impersonate another user on the system.

IBM Storage TS4500 Library and IBM Diamondback Tape Library versions 1.1.1.6 through 1.12.0.3 could allow an authenticated user to cause a denial of service using specially crafted SMTP requests that consume excessive amounts of system resources.

Pillow from 9.1.0 until 13.0.0 can disclose uninitialized stack memory when Image.quantize() uses an empty palette. ImagingPaletteCacheUpdate() leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as output pixel indices in a returned PNG or GIF.

In Pillow from 5.3.0 until 13.0.0, the library can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The _decodeStrip and _decodeTile buffers can be larger than the bytes written by libtiff, and Pillow does not clear the unwritten tail. An attacker can supply a crafted TIFF to an application that loads and returns or re-encodes its pixels.

Pillow from 11.3.0 until 13.0.0 has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. The error path frees the output buffer without closing the TIFF handle, and later cleanup flushes through the write callback into freed memory.

Dolibarr up to 23.0.2 contains a vulnerability in an unknown function of htdocs/document.php in the CSP component. Manipulation leads to protection mechanism failure, and the attack can be executed remotely.

TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537 contains a vulnerability in the get_img_from_url function of ApiBillet/serializers.py in the APIv1 component. Manipulation of the img_url/image_url argument can lead to server-side request forgery, and the attack can be launched remotely.

TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to be applied inconsistently, allowing protected camera operations to be executed without a valid authenticated session.

The UpdateHub firmware-over-the-air client in Zephyr parses the CoAP probe response with the JSON library, which treats every descriptor field as optional. When the response omits the "sha256sum" field, the corresponding pointer stays NULL and the code calls strlen() on it before any validation, causing a read at address zero. Because the metadata is supplied entirely by the network peer (plain CoAP over UDP by default, without DTLS), an attacker can trigger the fault remotely.

Pillow from 8.2.0 until 13.0.0 can read past the tile buffer while copying four-byte pixels in the tiled-TIFF decoder. In _decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-copy loop walks beyond that allocation.

kiwilan php-archive up to 2.3.02 has a path traversal vulnerability in ArchiveZip::extract in src/Readers/ArchiveZip.php. The attack can be carried out remotely and a public exploit is available.

DiffSK configobj up to 5.0.9 has an inefficient regular expression complexity vulnerability in _sectionmarker in configobj/__init__.py. Remote exploitation is possible.