CVE Vulnerability Catalog

smrealms smr up to commit f40380c has a server-side request forgery vulnerability in isUrlReachable in src/pages/Account/AlbumEditProcessor.php via the Website argument. The attack can be launched remotely and the exploit is publicly disclosed.

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the file_etag option is not set, the ETag is built from the file's inode number, modification time and size.

Grav from 2.0.0 before 2.2.2 allows page editors to read protected configuration by adding config-*@ directives to page frontmatter forms. Attackers with page-edit permission can bypass the Twig sandbox config_denied_paths redaction to expose security.salt, plugin credentials, and Redis passwords to all visitors.

Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contain a Twig sandbox allowlist bypass because the column, contains, filterByValue, index, where, and multisort filters resolve caller-supplied keys via ArrayHelper::getValue() without consulting the sandbox security policy. Authenticated Control Panel users can supply dot-path keys to traverse the craft global and disclose the securityKey, database credentials, and auth tokens.

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, when passwordPolicy.maxPasswordHistory or doNotAllowUsername is set, guessed current or previous passwords, bypassing account lockout.

ptbsare anx-calibre-manager up to 1.13.12 has a server-side request forgery vulnerability in LLMClient.chat in blueprints/api/llm.py via the base_url argument. The attack can be initiated remotely and the exploit has been published.

A vulnerability was found in clientst0r up to version 3.17.586 in the _fetch_html function of locations/services/property_url_importer.py (Property URL Importer component). Manipulation of the url argument results in server-side request forgery, and the exploit has been made public and can be launched remotely.

A flaw was found in GIMP where importing a crafted SBZ palette without a color-model attribute causes a NULL pointer dereference during string comparison. This results in denial of service of the GIMP application.

A vulnerability was detected in clawhost up to version 0.0.45 in the handleRequest function of apps/clawhostgo/src/main/services/reverseProxy.ts (Reverse Proxy component). Manipulation of the token argument results in open redirect, the attack can be initiated remotely, and the exploit is now public.

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv. A decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references, so a filter that removes the last single-key filter frees the callback table while the decode is in progress.

In the Cpanel::JSON::XS Perl library (versions 4.33 to 4.80), duplicate non-ASCII bare keys are not detected, leading to type confusion under dupkeys_as_arrayref in decode_hv. A repeated key replaces the earlier value, and a further repeat may treat the value as an array and dereference a pointer from a JSON number.

Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability allowing remote attackers to impersonate the trusted address bar by entering fullscreen mode via the Fullscreen API without a persistent notification or trusted-origin indicator. After a single user tap, attackers can render a counterfeit address bar showing a trusted origin over attacker-controlled content.

GPAC Project/MP4Box version 2.5-DEV-rev1593-gfe88c3545-master contains a heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c). An attacker can supply a crafted AC4 file to cause a denial of service (DoS).

Element X iOS before version 26.05.0 fails to check the URL allowlist when parsing io.element.call:// URLs. If an attacker tricks a user into opening a maliciously crafted io.element.call:// URL, they can load an attacker-controlled origin inside the call screen's WKWebView, which is granted device microphone and camera permissions (if previously granted to the app).

IBM Cloud Pak System 2.3.6.0 and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code that, when viewed, is executed in the victim's web browser within the security context of the hosting site.

IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.

IBM Concert 1.0 through 3.0.0 allows web page cache to be stored locally, which can be read by another user on the system.

IBM Concert 1.0 through 3.0.0 allows information disclosure through exposure of schema suggestions.

IBM Cloud Pak System 2.3.6.0 and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

IBM Concert versions 1.0 through 3.0.0 is vulnerable to information disclosure via heap inspection. The flaw may allow leakage of data from application memory.