CVE Vulnerability Catalog

OptimiDoc Server (On-Premise) stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, including SMTP, FTP (for scan delivery), Active Directory (for user list import), and SharePoint credentials, in cleartext via the web administration panel page source, allowing exposure of sensitive third-party authentication data. This issue was fixed in version 26.08.

This CVE has been rejected because Red Hat Product Security determined that this CVE ID is not needed.

Error in handling the PlatformLangCodes UEFI variable could cause a buffer overflow, leading to resource exhaustion and failure.

An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege.

The hard disk password is stored in plaintext in a UEFI variable.

Vulnerability in RightNow-AI OpenFang up to 0.6.9, affecting the shell_exec function in crates/openfang-runtime/src/tool_runner.rs, leading to uncontrolled memory allocation. The attack can be performed remotely, and the exploit is publicly available.

Vulnerability in simular-ai Agent-S up to 0.3.2, affecting unknown functionality in grounding.py of the Model-generated GUI Action Execution Workflow component, leading to denial of service. The attack can be launched remotely, and the exploit is publicly available.

Vulnerability in simular-ai Agent-S up to 0.3.2, affecting the ImageData function in gui_agents/s1/utils/ocr_server.py of the OCR HTTP API component. Manipulating the img_bytes argument leads to resource consumption. The attack can be launched remotely, and the exploit is publicly disclosed.

Vulnerability in simular-ai Agent-S versions 0.3.1 and 0.3.2, affecting an unknown function in code_agent.py of the CodeAgent component, leading to denial of service. The attack can be launched remotely, and the exploit is publicly disclosed.

An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service.

fast-uri accepts a host containing an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse() returns it as the host with error undefined, while Node's URL and the HTTP clients built on it resolve the same string to a different host. An application that reads the parsed host to make a host decision, such as an SSRF denylist, a redirect allowlist, or proxy routing, and then passes the original URL to an HTTP client evaluates its policy against a string that is not the host the request reaches. The same host is carried through normalize, equal, and resolve. This affects fast-uri versions 2.4.5, 3.1.6, and 4.1.3, and is fixed in 2.4.6, 3.1.7, and 4.1.4, where parse() reports a malformed host for any host that contains a bracket but is not a valid IPv6 literal.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

A vulnerability was found in sigoden aichat up to version 0.30.4, involving uncontrolled memory allocation in an unknown function of the file src/serve.rs in the API Endpoint component. The attack can be launched remotely.

A denial of service vulnerability was found in rowboatlabs rowboat up to version 0.9.1, affecting the request.text/req.json function in the file apps/rowboat/app/api/composio/webhook/route.ts of the Composio Webhook Endpoint component. The attack can be launched remotely. Version 0.9.2 resolves the issue but removes the legacy Next.js app without security controls.

A path traversal vulnerability was found in Reader Tools PDF Reader App version 98.8 on Android. The issue affects the ActSplashNew.handleDeeplink function of the File Handler component. Manipulating the _display_name argument allows a local attack.

Windows ML CLI before version 0.4.0 exposes commands through a localhost HTTP API without authentication and with wildcard allow_origins. A malicious website can send requests to /v1/cli/build or /v1/cli/config with trust_remote_code=true, leading to import of Python code from an attacker-controlled repository and arbitrary code execution as the server user.

fast-uri serializes the port component of a URI without validation. When recomposing the authority, the port is concatenated verbatim, so a non-digit port can inject authority delimiters, pointing the authority at an attacker-controlled host. This affects versions before 2.4.6, from 3.0.0 before 3.1.7, and from 4.0.0 before 4.1.4.

UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public storage disk and execute arbitrary OS commands on the server.

Previously, a channel registered in the mux's chanList was not usable until established. A malicious peer could flood the channel's incomingRequests, deadlocking the entire connection. Now, an atomic established state is added, set when a channel becomes usable. Until then, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.