CVE Vulnerability Catalog

An off-by-one vulnerability has been identified in the libarchive library when handling file name prefixes and suffixes. This flaw causes a 1-byte write overflow, potentially corrupting adjacent memory and leading to unpredictable program behavior or crashes.

An integer overflow vulnerability has been identified in the libarchive library when processing WARC files claiming more than INT64_MAX - 4 content bytes. An attacker can craft a malicious WARC archive to trigger this overflow, leading to unpredictable behavior, memory corruption, or denial of service. This affects libarchive versions prior to 3.8.0.

Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allowing authenticated users with System Manager privileges to view team details they should not have access to via direct API requests to team endpoints, even when explicitly configured with 'No access' to Teams in the System Console.

Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users accessing channel member information. Authenticated guest users can view metadata about members of public channels via the channel members API endpoint.

The PhonePe App 25.03.21.0 on Android has a vulnerability involving cleartext storage in a file or on disk in the SQLite database. The attack requires local access and root privileges.

A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. This may result in undefined behavior, allowing an attacker to bypass cookie expiration logic, causing persistent or unintended cookie behavior.

Mattermost versions 10.5.x <= 10.5.3 and 9.11.x <= 9.11.11 fail to check the RestrictSystemAdmin setting if a user doesn't have access to ExperimentalSettings, allowing a System Manager to access ExperimentalSettings when RestrictSystemAdmin is true via System Console.

A security flaw in Dígitro NGC Explorer up to 3.48.21 involves an unknown function of the Password Transmission Handler, resulting in client-side enforcement of server-side security. The attack can be initiated remotely but is difficult to exploit. Upgrading to version 3.48.22 resolves the issue.

A vulnerability in q2apro-on-site-notifications up to version 1.4.6 allows XSS attacks via the process_request function in q2apro-onsitenotifications-page.php. The attack can be performed remotely. Upgrading to version 1.4.8 addresses the issue.

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts containing actions created by the Playbooks bot, even without channel access or appropriate permissions.

In netstat in BusyBox through 1.37.0, local users can launch a network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.

W BusyBox w wersji do 1.37.0, w narzędziu tar, archiwum TAR może ukrywać nazwy plików w liście za pomocą sekwencji ucieczki terminala. To może prowadzić do nieświadomego ujawnienia danych lub manipulacji plikami.

Convertigo before 8.3.11 has a vulnerability in TwsCachedXPathAPI that does not restrict commons-jxpath functions, potentially allowing expression injection in contexts where an attacker can influence an evaluated XPath expression.

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.9 fail to restrict domains the LLM can request to contact upstream. This allows an authenticated user to exfiltrate data from an arbitrary server accessible to the victim via performing a prompt injection in the AI plugin's Jira tool.

Mattermost versions 10.5.x <= 10.5.1 and 9.11.x <= 9.11.9 fail to enforce MFA checks in the PUT /api/v4/users/user-id/mfa endpoint when the requesting user differs from the target user ID. This allows users with the edit_other_users permission to activate or deactivate MFA for other users, even if those users have not set up MFA.

Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, and 9.11.x <= 9.11.9 fail to prevent Wrangler posts from triggering AI responses. A user without access to the AI bot can activate it by attaching the activate_ai override property to a post via the Wrangler plugin, provided both the AI and Wrangler plugins are enabled.

Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to check if a file has been deleted when creating a bookmark which allows an attacker who knows the IDs of deleted files to obtain metadata of the files via bookmark creation.

Mattermost versions 9.11.x <= 9.11.8 fail to enforce proper access controls on the /api/v4/audits endpoint. This allows users with delegated granular administration roles who lack access to Compliance Monitoring to retrieve User Activity Logs.

A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string.