CVE Vulnerability Catalog

Gradle, a build automation tool, has a vulnerability that allows files to be written to unintended locations in the filesystem through specially crafted dependency coordinates. This could lead to poisoning the dependency cache or overwriting important files.

Hnswlib version 0.7.0 has a double free in init_index when the M argument is a large integer.

pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker can craft a PDF that leads to unexpected long runtime, blocking the current process and utilizing 100% of a single CPU core.

The pypdf library in version 2.10.5 contains a vulnerability that allows an attacker to craft a PDF leading to an infinite loop. This loop blocks the current process and utilizes 100% of a single CPU core.

In pacparser before version 1.4.2, there is a vulnerability in the pacparser_find_proxy function that allows JavaScript injection, potentially leading to privilege escalation if the attacker controls the URL.

In MISP before version 2.4.172, the title_for_layout parameter is not properly sanitized in Correlations, CorrelationExclusions, and Layouts.

An issue was discovered in the ProofreadPage extension for MediaWiki through version 1.39.3, which may expose hidden users via public interfaces.

An issue was discovered in the DoubleWiki extension for MediaWiki through 1.39.3 that allows XSS via the column alignment feature.

An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through version 1.39.3, allowing XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate for quotes that can be in a title attribute.

An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3. Because it doesn't use EditEntity for undo and restore, the intended interaction with AbuseFilter does not occur.

An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3. There is incorrect access control for visibility of hidden users.

The angular-ui-notification library versions 0.1.0, 0.2.0, and 0.3.6 were found to contain a cross-site scripting (XSS) vulnerability.

Joplin before 2.11.5 allows XSS via an AREA element of an image map.

Joplin versions before 2.11.5 allow XSS via a USE element in an SVG document.

The web interface of Gira KNX/IP-Router 3.1.3683.0 and 3.3.8.0 is vulnerable to reflective XSS attacks. It responds with a '404 - Not Found' status code for non-existent paths, but the value of the path is reflected in the response.

A critical vulnerability was found in IBOS OA version 4.5.5, affecting the actionEdit function of the file ?r=dashboard/roleadmin/edit&op=member of the Add User Handler component. Manipulation of the argument id leads to SQL injection.

A Cross-site Scripting (XSS) vulnerability is reflected in the GitHub repository hestiacp/hestiacp prior to version 1.7.8. An attacker could exploit this flaw to inject malicious scripts.

A critical vulnerability was found in Campcodes Retro Cellphone Online Store version 1.0, affecting an unknown function in the file /admin/edit_product.php. Manipulation of the argument username leads to SQL injection.

Some Zoom clients may expose information intended to be encrypted, potentially leading to the disclosure of sensitive data.

A reflected cross site scripting (XSS) vulnerability was discovered in Sophos Web Appliance v4.3.9.1 that allows for arbitrary code to be inputted via double quotes.