CVE Vulnerability Catalog

A vulnerability was found in the XFIXES extension where the XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash.

Klasa html.parser.HTMLParser miała najgorszą złożoność kwadratową podczas przetwarzania niektórych specjalnie przygotowanych, źle sformatowanych danych wejściowych, co mogło prowadzić do wzmocnionego ataku typu denial-of-service.

A path traversal vulnerability exists in Erlang/OTP stdlib's zip functions (zip:unzip/1,2 and zip:extract/1,2) unless the memory option is used. This allows file manipulation outside the target directory.

In GIMP, the "Despeckle" plug-in has an integer overflow vulnerability. Unchecked multiplication of image dimensions (width, height, bytes-per-pixel) can cause insufficient memory allocation and out-of-bounds writes.

A zip path traversal vulnerability exists in the module installation process of Mendix Studio Pro 9, 10, 11 and 11.12 (Windows and Mac versions). By crafting a malicious module and distributing it via the Mendix Marketplace, an attacker could write or modify arbitrary files outside a developer's project directory.

Mattermost versions 10.7.x <= 10.7.1, 10.6.x <= 10.6.3, 10.5.x <= 10.5.4, and 9.11.x <= 9.11.13 fail to properly validate LDAP group ID attributes. An authenticated administrator with PermissionSysconsoleWriteUserManagementGroups can execute LDAP search filter injection via the PUT /api/v4/ldap/groups/{remote_id}/link API when objectGUID is configured as the Group ID Attribute.

Cross-Site Scripting (XSS) vulnerability in Jetimob Plataforma Imobiliaria version 20240627-0. An attacker can inject malicious script via the "Profisso" field in the "Pessoas" section.

A Cross-Site Scripting (XSS) vulnerability was found in Jetimob Plataforma Imobiliaria version 20240627-0. The 'Descrico' form field in the 'Oportunidades' section during activity creation or editing allows JavaScript injection.

Cross-Site Scripting (XSS) vulnerability in Jetimob Plataforma Imobiliaria allows an attacker to inject malicious script into the 'Título' (title) field within the filter save option of the 'Busca' (search) function.

A Cross Site Scripting (XSS) vulnerability was found in Jetimob Plataforma Imobiliaria 20240627-0 in the 'Observaces' (observances) form field within the 'Pessoas' (persons) section when creating or editing a legal or natural person. An attacker can inject malicious JavaScript code that executes in the victim's browser.

In the TCG TPM2.0 Reference implementation, the CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to lack of validation of the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009.

In vulnerability CVE-2025-25250 in Fortinet FortiOS, an authenticated user can access full SSL-VPN settings via a crafted URL. This affects FortiOS versions 7.6.0, 7.4.0 through 7.4.7, as well as all versions of 7.2, 7.0, and 6.4, and FortiSASE 25.1.c.

FortiOS versions 7.6.1 and below, and 7.4.7 and below, have an Improper Certificate Validation vulnerability. This may allow an EAP verified remote user to connect from FortiClient using a revoked certificate.

FortiOS SSL-VPN has an insufficient session expiration vulnerability that allows an attacker with a cookie used for login to log in again, even if the session has expired or was logged out.

HAX CMS PHP prior to version 11.0.0 contains an authenticated Local File Inclusion (LFI) vulnerability in the saveOutline endpoint that allows a low-privileged user to read arbitrary files on the server by manipulating the location field in site.json. This enables exfiltration of sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server.

A heap buffer over-read vulnerability has been identified in the libarchive library. The issue occurs when the size of a filter block exceeds the LZSS window, potentially causing the library to read beyond allocated memory, leading to unpredictable behavior, crashes, or disclosure of sensitive information.

A stored cross-site scripting (XSS) vulnerability in Anchor CMS v0.12.7 allows attackers to inject malicious JavaScript via the page description field in the page creation interface (/admin/pages/add).

A vulnerability in the nbdkit "blocksize" filter allows a malicious client to trigger an internal error by requesting block status information for an excessively large data range. This leads to a denial of service (DoS) of the nbdkit server.