CVE Vulnerability Catalog

Mattermost versions 10.1.x <= 10.1.3, 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to restrict channel export of archived channels when the "Allow users to view archived channels" is disabled, which allows a user to export channel contents when they shouldn't have access to it.

A vulnerability in GRUB2 involves an integer overflow in a 32-bit variable tracking input length during keyboard read operations, leading to a heap-based buffer overflow. This can corrupt critical internal data within GRUB.

The Autoship Cloud for WooCommerce Subscription Products plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'autoship-create-scheduled-order-action' shortcode in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The vulnerability in DDSN Interactive cm3 Acora CMS version 10.1.1 stems from improper access control. An editor-privileged user can access sensitive information, such as system administrator credentials, by force browsing the endpoint and exploiting the 'file' parameter. By referencing specific files (e.g., cm3.xml), attackers can bypass access controls, leading to account takeover and potential privilege escalation.

A flaw was found in grub2's UFS module when handling symbolic links. The function checking symlink data size does not verify overflow, leading to undersized buffer allocation and heap out-of-bounds write. An attacker can craft a malicious filesystem to corrupt heap memory and achieve arbitrary code execution, bypassing Secure Boot.

A flaw in Grub2 allows the dump command to read arbitrary memory even when Grub is in lockdown mode, enabling an attacker to extract sensitive information such as signatures and salts from memory.

A flaw in grub2's calculation of the translation buffer when reading a .mo file in grub_gettext_getstr_from_position() may overflow, leading to an out-of-bounds write. An attacker can exploit this to overwrite sensitive heap data, ultimately bypassing Secure Boot protections.

A flaw in the GRUB2 command/gpg component causes hooks created by loaded modules not to be removed when the module is unloaded. This allows an attacker to trigger a use-after-free vulnerability by calling a hook after its module has been freed. Successful exploitation could lead to arbitrary code execution and bypass of Secure Boot protections.

A flaw was found in the GRUB2 bootloader in the HFS+ filesystem driver. When failing to mount an HFS+ partition, the driver does not properly set an ERRNO value, which may lead to a NULL pointer access.

A flaw was found in grub2 where it fails to validate the string length when reading a symbolic link's name from a UFS filesystem. This lack of validation may lead to a heap out-of-bounds write, compromising data integrity and potentially allowing an attacker to bypass Secure Boot protections.

In the grub_mofile_open() function when reading a language .mo file, GRUB2 fails to verify an integer overflow when allocating its internal buffer. A crafted .mo file may lead to buffer size calculation overflow, resulting in out-of-bound reads and writes.

A flaw was found in grub2 where the grub_extcmd_dispatcher() function calls grub_arg_list_alloc() to allocate memory for the argument list, but fails to check if the allocation succeeded. If allocation fails, the parse_option() function processes a NULL pointer, causing grub to crash or, in rare scenarios, corrupt IVT data.

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key.

A flaw in grub2 allows an attacker to cause an out-of-bounds write by providing a specially crafted JPEG file to the JPEG parser. This can lead to memory corruption.

Memory safety bugs present in Firefox 135 could lead to memory corruption and potentially arbitrary code execution. Fixed in Firefox 135.0.1.

Podatność typu 'Open Redirect' w systemie HAVELSAN Liman MYS umożliwia przekierowanie użytkowników do nieufnych stron. Problem ten dotyczy wersji Liman MYS przed 2.1.1 - 1010.

Podatność typu 'Path Traversal' w serwerze KLog firmy Komtera Technologies pozwala na manipulację danymi wejściowymi z sieci w wywołaniach systemowych do plików. Problem ten dotyczy wersji KLog Server przed 3.1.1.

The PAM module pam_cap.so of libcap configuration supports group names starting with "@", but during actual parsing, configurations not starting with "@" are incorrectly recognized as group names. This may result in unintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.

A flaw was found in the Keycloak organization feature, which allows incorrect assignment of an organization to a user if their username or email matches the organization's domain pattern. This occurs at the mapper level, leading to misrepresentation in tokens.

W bibliotece GNU elfutils w wersji 0.192 zidentyfikowano krytyczną podatność, która dotyczy funkcji __libdw_thread_tail w pliku libdw_alloc.c komponentu eu-readelf. Manipulacja argumentem w prowadzi do uszkodzenia pamięci.