CVE Vulnerability Catalog

UpSignOn for Windows before version 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even after the application has been locked. Attackers can use the PROCESS_VM_READ permission to read the memory space of UpSignOn.exe and extract sensitive fields including entry names, URLs, usernames, passwords, TOTP secrets, and notes.

UpSignOn for Windows before version 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key stored in the Windows PasswordVault API without triggering any authentication prompt. Attackers can access the stored biometric key from a standard local process within the same Windows session to decrypt the protected vault files and export the entire password manager contents in cleartext.

UpSignOn for Windows before version 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers can extract the backup key from process memory to decrypt the encrypted master password backup stored in v6-vault1.DATA.txt, then use the recovered master password to decrypt the main vault and export all password manager entries in cleartext.

The SEOWriting plugin for WordPress through version 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious JavaScript by exploiting an overly permissive KSES allowlist that explicitly permits the onload event handler on iframe elements. Attackers can store crafted JavaScript payloads in post content that execute when the affected post is viewed or previewed by higher-privileged users, potentially leading to privilege escalation or account compromise.

After a channel is established, a malicious peer could send crafted messages causing a deadlock of the entire connection. Now all RFC 4254 channel messages are handled, and global requests are explicitly processed. Other messages are treated as protocol errors and the connection is torn down instead of buffering and blocking.

A heap overflow in the SMM module may allow an attacker with access to a second vulnerability enabling writes to SPI flash to potentially execute arbitrary code.

Insufficient verification of data authenticity in AGESA™ may allow an attacker to update SPI ROM data, potentially resulting in denial of service or privilege escalation.

A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. It affects unknown code, and the manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released publicly. Upgrading to version 0.5.1 resolves the issue.

A vulnerability was identified in tsi-coop tsi-dpdp-cms up to version 0.5.0 in the file InterceptingFilter.java of the Bootstrap Setup Endpoint component. Manipulation leads to missing authentication. The attack can be initiated remotely, and the exploit is publicly available.

A vulnerability was found in tsi-coop tsi-dpdp-cms up to version 0.5.0 in the file web.xml of the Admin Console/DPO Compliance Console component. Executing a manipulation leads to missing authentication. The attack can be launched remotely, and the exploit has been publicly disclosed.

HTTPX2 before version 2.12.0 fully inflates each gzip, deflate, br, or zstd network chunk before yielding bounded pieces to the application. A 64 KiB compressed chunk can expand to approximately 64 MiB in one intermediate allocation, causing severe memory pressure or out-of-memory termination even when streaming. Fixed in version 2.12.0.

HTTPX2 before 2.10.0 fails to start TLS when using SOCKS5 proxy for wss origins because the TLS upgrade condition only recognizes https. HTTPX2 exposes this via Client.websocket() and AsyncClient.websocket() from 2.6.0 to 2.9.1, allowing plaintext transmission without certificate verification. Fixed in httpcore2 2.10.0 and HTTPX2 2.10.0.

Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.

A vulnerability was found in ntegrals openbrowser up to version 067fc45d649baa961750da8e2f4a75d87c5c75c8 in the file packages/core/src/agent/agent.ts of the Browser Agent Message Construction component. Performing a manipulation results in resource consumption. The attack can be initiated remotely, and the exploit has been made public.

In HTTPX2 prior to version 2.11.0, a vulnerability was found in Request._prepare() in src/httpx2/httpx2/_models.py. It can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault() processing checks each default header independently rather than treating the two framing headers as mutually exclusive. This can allow request smuggling or connection desynchronization.

In HTTPX2 prior to version 2.11.0, a vulnerability was found in FileField.render_headers() in src/httpx2/httpx2/_multipart.py. It directly interpolates attacker-controlled content_type values and custom headers from the files= tuple into multipart/form-data part headers without validating header names or values. CR or LF characters can terminate a part header, inject additional part headers, or end the part header block early, allowing a downstream multipart parser to treat attacker-supplied lines as genuine headers and potentially alter part semantics or bypass header-based checks.

In HTTPX2 from version 2.5.0 until 2.10.0, a vulnerability was found in the Server-Sent Events parser in src/httpx2/httpx2/_sse.py. The _SSELineDecoder.decode() method repeatedly copies and rescans buffered text when an attacker-controlled or compromised SSE endpoint splits one unterminated line across many response chunks. The total processing work grows quadratically with the line length, allowing a crafted stream to consume excessive CPU and block a synchronous worker or asynchronous event loop.

In LiteLLM prior to versions 1.88.6 and 1.96.2, a vulnerability allowed any authenticated proxy user to redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials to that destination. Request validation in several files used incomplete checks that did not cover every sensitive parameter or inspect equivalent values across nested request fields, path values, and bracket-notation form data. Routing and credential parameters including api_base, base_url, model_list, fallbacks, and litellm_credential_name could therefore be applied without clearing the operator's stored key, exposing upstream provider credentials and other configured secrets and permitting server-side requests to internal services reachable by the proxy.

In libjxl before 0.12, an integer underflow vulnerability exists in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to size_t on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse attacker-controlled codestream bytes as phantom box headers, enabling injection of arbitrary metadata (Exif, XMP, IPTC, JUMBF) and potential out-of-bounds reads.

In Sonatype Nexus Repository 3, two blobstore group management REST API endpoints did not correctly enforce authorization. A user with only nexus:blobstores:create permission could convert an existing blobstore into a group blobstore, an action requiring nexus:blobstores:update. This could lead to unauthorized modification of blobstore configuration.