CVE Vulnerability Catalog

A vulnerability was discovered in the resolv gem before 0.7.2 for Ruby. The DNS encoder writes label lengths into a single octet without range checking, allowing values from 0 to 255, including reserved compression pointer ranges. An attacker-controlled hostname can cause the wire bytes to describe a different name than intended, bypassing allowlists and egress controls.

In the resolv gem before version 0.7.2 for Ruby, during decoding of DNS responses, a new class is generated for each unknown record (type, class) pair or SvcParamKey, and permanently registered as a constant and in hashes, causing unbounded memory growth. An attacker controlling DNS responses can send a response with thousands of unknown types, causing permanent process memory growth that is not reclaimed by GC.

FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5($_POST['password']) to add_user() and update_user_password(), admin/change_current_user_password.php does the same when a user changes their own password, the forgotten-password path in includes/current_user.inc hashes the newly generated password the same way, and authentication calls get_user_auth($loginname, md5($password)). The codebase applies no per-password salt and contains no call to password_hash(), password_verify() or any other adaptive hash, so identical passwords yield identical digests and an attacker who obtains the user table can recover plaintext passwords with precomputed lookup tables or high-rate GPU cracking.

FrontAccounting through 2.4.20 generates a CSRF token in end_form() in includes/ui/ui_controls.inc and embeds it as the _token hidden field in every form it renders, but only admin/users.php and admin/change_current_user_password.php call check_csrf_token() to validate it. No financial transaction handler validates the token, including gl/gl_journal.php, gl/gl_bank.php, purchasing/supplier_invoice.php, sales/customer_invoice.php, sales/customer_payments.php and admin/company_preferences.php, so those endpoints act on POST data with no origin check. An attacker who gets an authenticated user to load a page under attacker control can auto-submit a cross-origin form to any of them and have the forged journal entry, invoice, customer payment, bank transaction or company configuration change recorded under the victim's session.

Vulnerability in Fonoster up to 0.22.7 allows an authenticated user to rename any workspace. The updateWorkspace handler does not stop execution after reporting lack of membership, and access control does not cover this operation.

APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount with requiredLogin = false. ResourceInterceptor honors that annotation by returning before any session or API key is validated, and the nginx gateway proxies every /api request to the backend. An unauthenticated attacker can enumerate accounts in the cooling-off period and close them, deleting account data and preventing recovery.

Vulnerability in APITable up to 1.13.0-beta.1 allows an unauthenticated attacker to create notifications in the system. Missing required login for the create handler of InternalNotifyController and nginx proxy allow access to the API.

The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities.

Reflected XSS in Netron versions up to 9.1.2 in the desktop application through unsanitized node names. An attacker can hide nodes, perform port scanning, or abuse a Chrome n-day to achieve remote code execution.

Reflected XSS in Netron versions up to 9.1.2 in the desktop application through unsanitized node names. An attacker can hide nodes, perform port scanning, or abuse a Chrome n-day to achieve remote code execution.

Reflected XSS in Netron versions up to 9.1.2 in the desktop application through unsanitized node names. An attacker can hide nodes, perform port scanning, or abuse a Chrome n-day to achieve remote code execution.

Vulnerability in Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0 allows an attacker to manipulate the filename upon upload, enabling arbitrary file path traversal when file system storage is used.

DJI drones contain an FTP service with hardcoded credentials shared across affected models, allowing authenticated users to upload files without limits and overwrite files in **/blackbox/upgrade/**. An attacker with network or USB RNDIS access can exhaust storage, preventing flight records and firmware updates. Uploaded files persist across reboot and factory reset.

A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect outbound model requests to an externally-controlled endpoint via a crafted inline flow configuration that overrides the HTTP Host header, resulting in disclosure of Google Cloud Vertex cloud service credentials and private signing keys.

In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured output can use the password to access the TLS client key.

An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components.

An unauthenticated client that can reach a MongoDB Connector for BI deployment configured with Kerberos authentication may cause mongosqld to terminate when a crafted authentication exchange encounters a specific GSSAPI error-handling condition. This can interrupt BI Connector availability until the process restarts.

In wicked up to version 0.6.80, an out-of-bounds read exists in the DHCPv4 packet capture code. The function ni_capture_inspect_udp_header() incorrectly reports the payload length, causing the DHCPv4 client to read up to 68 bytes past the receive buffer. An unauthenticated attacker on the same network can cause adjacent heap memory to be interpreted as DHCP options.

In wicked up to version 0.6.80, an integer underflow exists in the DHCPv4 packet capture code. The function ni_capture_inspect_udp_header() does not verify that the IP total length field is at least as large as the IP header length before subtracting. An unauthenticated attacker on the same network can trigger an out-of-bounds read, potentially crashing the daemon.