CVE Vulnerability Catalog

A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, caused by improper validation of lobby data fields related to kicked players. The function processes a list of kicked player identifiers using the "kick_num" key without validating its bounds, allowing an attacker to supply an oversized value and overwrite adjacent memory structures, including Steam callback handlers. Successful exploitation may enable control-flow hijacking and arbitrary code execution within the game process.

RansomLook exposes sensitive operator-side scraping configuration through multiple unauthenticated API responses. Location records associated with ransomware groups and markets are returned largely verbatim to unauthenticated callers whenever the location itself is not marked as private. These records may contain internal fields such as authentication headers, session cookies, init scripts, and browser details.

RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and passed to WeasyPrint for PDF rendering. Prior to the fix, WeasyPrint used its default URL fetcher, allowing resource references contained in an analysis to be resolved without restrictions.

RansomLook contains a path traversal vulnerability in the handling of the screen field associated with group posts. The GroupPost.get API handler concatenates the database-controlled screen value directly with the application's source/ directory and opens the resulting path without verifying that the resolved file remains within the intended directory. A malicious upstream instance can provide traversal sequences such as ../config/generic.json, leading to arbitrary file read.

The vulnerability in RansomLook is due to the failure to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels. The post-processing logic only checks whether an individual post is marked private, but does not verify whether the group or market to which the post belongs is configured as private. As a result, victim information from private groups or markets may be automatically published through enabled Rocket.Chat, Mastodon, Bluesky, and email notification channels, as well as added to the public MISP feed.

Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlled input before it is incorporated into Redis SCAN MATCH patterns. An unauthenticated attacker could supply Redis glob metacharacters such as *, ?, [ or ] to broaden the SCAN operation beyond the intended group, potentially exposing health information, mirror slugs, and uptime series belonging to all groups and markets, including private entities. Similar unsafe interpolation was present in /api/crypto/chain/<chain> and in the delete_manual_torrent() function, where it could lead to deletion of torrent-health keys belonging to other torrents.

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.

RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with private entities through several web views and API endpoints. The /compare functionality can also be queried directly with the name of a private entity, allowing an unauthorized user to retrieve information such as post counts, mirror totals, and uptime even when the entity is excluded from the normal user interface.

RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to remain private. The /export/<database> endpoint permits selected internal databases to be exported without requiring authentication. While limited filtering is performed for some entity databases, other exportable databases are returned directly without consistently applying the application's private-entity access restrictions. As a result, information associated with groups, markets, posts, or other records marked as private may be included in an export accessible to an unauthenticated requester.

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism.

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression.

A vulnerability was identified in bytebot-ai bytebot 0.0.1. The affected element is an unknown function of the component Agent Execution Workflow. Such manipulation leads to infinite loop. The attack may be performed from remote. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.

A vulnerability was determined in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/ajax.php?action=save_settings. This manipulation of the argument Name causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

Vulnerability in miniOrange Joomla extensions allows account takeover via cookie manipulation. An attacker can log in as any user, including admins.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied workflow_run_backend_id and never check that it belongs to the requester: validateRunIDV4 in pkg/artifacts/artifacts_v4.go parses the value and returns it with the comparison against the requesting task's run ID left commented out.

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with fs.openSync(path, "w", 0o666), which resolves symbolic links and carries neither O_NOFOLLOW nor a pre-write fs.lstatSync check. When a path component at the destination already exists as a symbolic link pointing outside the extraction root, extractAllTo, extractAllToAsync and extractEntryTo write the entry contents through that link and then chmod its target, placing attacker-controlled content in a file outside the root without any traversal sequence appearing in the archive. Reaching the write requires overwrite to be enabled, because the preceding fs.existsSync check also resolves the link and otherwise declines.

zlib versions 1.2.11 through 1.3.2 contain a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call.

Official Flair wheels for versions 0.15.0 and 0.15.1 still contain flair/models/clustering.py, which executes arbitrary Python code when loading a model. The previous fix for CVE-2024-10073 does not remove this issue from the distributed package.

Mercado Pago Node.js SDK does not encode identifiers in API paths, allowing request manipulation. An attacker can redirect requests to a different endpoint or append query parameters, using the merchant's access token.