CVE Vulnerability Catalog

Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained with other vulnerabilities, could be used to escalate privileges. This bug only affects Thunderbird for macOS. Fixed in Firefox 138, Firefox ESR 128.10, Firefox ESR 115.23, Thunderbird 138, and Thunderbird 128.10.

A flaw was found in the libsoup library in cookie handling. libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own.

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there is a possibility for denial of service by memory exhaustion when net-imap reads server responses. A malicious server can send a "literal" byte count, which is automatically read by the client's receiver thread, causing immediate memory allocation.

A flaw in the libsoup library causes HTTP clients to mistakenly send the Authorization header to the new host during a redirect. This allows the new host to impersonate the user to the original server.

A flaw was found in the libsoup library causing memory leaks in the soup_header_parse_quality_list() function when parsing a quality list containing elements with all zeroes.

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks plugin. An attacker can create a specially crafted post with maliciously crafted props.

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation. An attacker can create task items containing an excessive number of actions triggered by specific posts.

In the xfig diagramming tool, a segmentation fault occurs in fig2dev within the read_arcobject function, allowing an attacker to cause a denial of service via local input manipulation.

A vulnerability was found in fig2dev that allows an attacker to manipulate local input in the genge_itp_spline function, potentially leading to availability issues.

In the xfig diagramming tool, a stack overflow while running fig2dev allows memory corruption via local input manipulation in the read_objects function.

pnpm is a package manager that prior to version 10.0.0 used the md5 function for path shortening. In case of a collision, different libraries could share the same storage path, leading to version identification issues.

A vulnerability was found in mod_proxy_cluster where the <Directory> directive is incorrectly used instead of <Location>. The <Directory> directive does not restrict access based on IP address, allowing anyone with host access to send MCMP requests that can add, remove, or update load-balancing nodes.

A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the image parameter under the Create/Modify article function.

Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code in the admin API Access token generator.

A Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and earlier allows remote attackers to store arbitrary JavaScript code, potentially rendering the IP blacklist functionality unusable until the malicious content is removed from the database.

In the Linux kernel, raid10_handle_discard should wait for a barrier before returning a discard bio with REQ_NOWAIT. Failure to do so may cause issues and unnecessary warnings in dmesg.

A vulnerability in the Linux kernel affects memory error handling (MCE) and the hwpoison mechanism. Since version 5.17, regressions occur: when a memory error is found during copy_from_user, the kernel panics instead of returning -EFAULT; when a poison is found during instruction fetching in user space, the user process is killed by SIGBUS due to a race between #CMCI and #MCE.

In the Linux kernel, a NULL dereference vulnerability was resolved in ef100_process_design_param() in the sfc driver. ef100_probe_main() and ef100_check_design_params() run before efx->net_dev is created, so netif_set_tso_max_size() and _segs() cannot be called at that point.

The tokenizer incorrectly interprets tags with unquoted attribute values ending with a solidus character (/) as self-closing. When directly using Tokenizer, this can incorrectly mark such tags as self-closing, and when using Parse functions, content following such tags may be placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g., <math>, <svg> contexts).