CVE Vulnerability Catalog

In osTicket before version 1.10.7 and versions 1.12.x before 1.12.1, a stored XSS vulnerability was discovered in setup/install.php. Lack of input sanitization in the firstname and lastname fields allows injection of malicious queries that are then executed.

In osTicket before version 1.10.7 and 1.12.x before 1.12.1, a vulnerability was found in the ticket creation form. Users can upload files, but content checks are insufficient and the server response is not handled properly, leading to persistent XSS. An attacker can upload an .html file, and the Content-Disposition header is set to inline instead of attachment, enabling cookie theft or other malicious actions.

Double Free in VLC versions <= 3.0.6 leads to a crash.

In MISP 2.4.111, a stored XSS vulnerability exists in the event-graph view in app/webroot/js/event-graph.js, triggered when a user toggles the event graph view. A malicious MISP event must be crafted to exploit this vulnerability.

An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)

An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow.

GNU Libc jest podatny na obejście zabezpieczeń, co pozwala atakującemu na zgadywanie adresów sterty wątków utworzonych przez pthread. Problem dotyczy komponentu glibc.

GNU Libc jest podatny na obejście mitigacji ASLR, co pozwala atakującemu na wykorzystanie pamięci podręcznej stosu wątków i sterty. Komponentem dotkniętym tą podatnością jest glibc.

GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat."

http.cookiejar.DefaultPolicy.domain_return_ok in Python before 3.7.3 does not correctly validate the domain, allowing existing cookies to be sent to the wrong server. An attacker may abuse this by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.

A buffer overflow in iptables-restore in netfilter iptables 1.8.2 allows an attacker to (at least) crash the program or potentially gain code execution via a specially crafted iptables-save file. This is related to add_param_to_argv in xshared.c.

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. There is a heap-based buffer over-read in _bfd_doprnt in bfd.c because elf_object_p in elfcode.h mishandles an e_shstrndx section of type SHT_GROUP by omitting a trailing '\0' character.

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.

In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) NOTE: the vendor's position is that the issue report cannot be validated because there is no description of an attack

A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further developed into a remote code execution exploit.

An issue was discovered in MISP 2.4.108 that allows organization admins to reset passwords for site admins. This could lead to abuse when the host organization creates lower-privilege organization admins.

Wszystkie znane wersje konsoli zarządzania Orpak SiteOmat są podatne na wielokrotne przypadki przechowywanego ataku typu Cross-site Scripting z powodu niewłaściwej walidacji danych wejściowych od użytkowników zewnętrznych. Atakujący z dostępem do interfejsu webowego może przejąć sesje lub przekierować ofiary na złośliwy serwer.

Podatność Microarchitectural Fill Buffer Data Sampling (MFBDS) dotyczy niektórych mikroprocesorów wykorzystujących spekulacyjną egzekucję, co może umożliwić uwierzytelnionemu użytkownikowi potencjalne ujawnienie informacji poprzez kanał boczny przy lokalnym dostępie. Lista dotkniętych produktów jest dostępna w dokumentacji Intel.

Podatność MLPDS dotyczy niektórych mikroprocesorów wykorzystujących spekulacyjną egzekucję, które mogą umożliwić uwierzytelnionemu użytkownikowi potencjalne ujawnienie informacji poprzez kanał boczny przy lokalnym dostępie. Lista dotkniętych produktów jest dostępna w dokumentacji Intel.