CVE Vulnerability Catalog

In the TCG TPM2.0 Reference implementation, the CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to lack of validation of the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009.

In vulnerability CVE-2025-25250 in Fortinet FortiOS, an authenticated user can access full SSL-VPN settings via a crafted URL. This affects FortiOS versions 7.6.0, 7.4.0 through 7.4.7, as well as all versions of 7.2, 7.0, and 6.4, and FortiSASE 25.1.c.

FortiOS versions 7.6.1 and below, and 7.4.7 and below, have an Improper Certificate Validation vulnerability. This may allow an EAP verified remote user to connect from FortiClient using a revoked certificate.

FortiOS SSL-VPN has an insufficient session expiration vulnerability that allows an attacker with a cookie used for login to log in again, even if the session has expired or was logged out.

HAX CMS PHP prior to version 11.0.0 contains an authenticated Local File Inclusion (LFI) vulnerability in the saveOutline endpoint that allows a low-privileged user to read arbitrary files on the server by manipulating the location field in site.json. This enables exfiltration of sensitive system files such as /etc/passwd, application secrets, or configuration files accessible to the web server.

A heap buffer over-read vulnerability has been identified in the libarchive library. The issue occurs when the size of a filter block exceeds the LZSS window, potentially causing the library to read beyond allocated memory, leading to unpredictable behavior, crashes, or disclosure of sensitive information.

A stored cross-site scripting (XSS) vulnerability in Anchor CMS v0.12.7 allows attackers to inject malicious JavaScript via the page description field in the page creation interface (/admin/pages/add).

A vulnerability in the nbdkit "blocksize" filter allows a malicious client to trigger an internal error by requesting block status information for an excessively large data range. This leads to a denial of service (DoS) of the nbdkit server.

A flaw exists in the nbdkit server when handling plugin responses about data block status. If a client requests a very large data range and a plugin responds with an even larger single block, the server may encounter a critical internal error, leading to a denial-of-service.

A flaw in Samba causes the smbd daemon to ignore group membership changes when re-authenticating an expired SMB session. This can expose file shares until clients disconnect and reconnect.

A vulnerability in Qt causes a crash when loading a specially crafted ICNS image file via QImage. Affects Qt versions 6.3.0 through 6.5.9, 6.6.0 through 6.8.4, and 6.9.0. Fixed in 6.5.10, 6.8.5, and 6.9.1.

A cross-site request forgery (CSRF) vulnerability was found in WuKongOpenSource WukongCRM 9.0 in the file /system/user/updataPassword. The attack can be launched remotely, and exploit details have been publicly disclosed.

A vulnerability in Python's tarfile module allows modifying file metadata or permissions outside the extraction directory when using filters 'data' or 'tar'. Affects Python 3.12+.

A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser to execute arbitrary JavaScript in the context of the vulnerable page. This vulnerability may allow UI manipulation, redirection to malicious websites, or data exfiltration from the browser. However, since all session-related sensitive cookies are protected with the httpOnly flag, session hijacking is not possible.

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previously issued tokens.

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to clear Google OAuth credentials when converting user accounts to bot accounts. This allows attackers to gain unauthorized access to bot accounts via the Google OAuth signup flow.

A vulnerability in systemd-coredump allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump. This enables reading sensitive data, such as /etc/shadow content, loaded by the original process.

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly validate permissions when changing team privacy settings. Team administrators without the 'invite user' permission can access and modify team invite IDs via the /api/v4/teams/:teamId/privacy endpoint.

A vulnerability in the mcp-markdownify-server package before version 1.0.0 allows unauthorized access to files and directories on the server via the get-markdown-file tool. An attacker can craft a malicious prompt that, when processed by the MCP host, enables reading arbitrary files from the system.