CVE Vulnerability Catalog

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed.

In the Linux kernel, the SMB client has a double-free vulnerability in SMB2_close() during replay. If a response-bearing attempt returns a replayable error and frees its response buffer, and then SMB2_close_init() fails before the next send, the buffer is freed again.

Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. A low-privileged user can invoke Admin REST APIs of WSO2 products.

The Conditional Authentication script does not correctly enforce the completion of all required authentication steps in a specific multi-step pattern. An attacker can bypass intermediate authentication challenges by exploiting how the script handles callbacks and re-execution.

The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine. This allows anonymous attackers to delete files staged in its upload directory and irreversibly destroy customers' pending order attachments.

The WPCargo Track & Trace WordPress plugin before version 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004.

A heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side FileSegment ASDU encoding path. The issue occurs because FileSegment_encode() validates only the standalone segment length via FileSegment_GetMaxDataSize() and does not verify the residual capacity of the current ASDU frame before encoding object fields and segment data.

In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues.

FrontMCP prior to 1.5.7 has a vulnerability in the codecall:execute tool that allows sandbox escape and remote code execution. By exploiting Zod objects, a script can access the Function constructor and execute arbitrary code in the server process. A single tools/call is sufficient to achieve full compromise.

Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to incorrect Access Control. The application fails to stop processing an incoming request in VuFind\Controller\AbstractBase::validateAccessPermission after it has found that controller level access permissions do not allow access to the requested function. The requester receives a response indicating that access was denied, but the actual function is executed regardless of that.

Nuxt before 3.3.1 in development mode exposes an unauthenticated RPC channel over the Vite HMR WebSocket. An attacker who can reach the HMR port can call methods like updateOptions() and openInEditor(), allowing arbitrary program execution on the developer's machine.

My Safetipin Android Application 5.2.1 contains hardcoded credentials in the authentication module, allowing remote attackers to bypass authentication and gain unauthorized access to user accounts via predictable OTP values.

boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users to inject arbitrary lines into the server's authorized_keys file. Attackers can insert a public key, gaining persistent shell access and reading credentials from the database.

GitHub Enterprise Server before version 3.22 has a path traversal vulnerability that allows an unauthenticated attacker to delete arbitrary files and directories on the instance, including the entire user storage directory containing Git LFS objects, release assets, attachments, and avatars. Exploitation of the X-GitHub-Request-Id header without sanitization as a filesystem path segment leads to data deletion.

PraisonAI before 4.6.40 contains a command injection vulnerability in the bundled Claude GitHub Actions workflow. The pull request branch name is embedded in a Bash block without validation, and any @claude comment can trigger the job, allowing outside contributors to execute arbitrary code in the runner.

In Jenkins 2.575 and earlier, and LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in Remoting deserialization. This allows agents, code on agents, and attackers with Agent/Connect permission to bypass the filter for classes on the Jenkins core classpath.

Vulnerability in Cisco Catalyst SD-WAN related to improper link resolution before file access (CWE-59). Discovered during internal security review, addressed in a software hardening release.

As part of an internal security review in Cisco Catalyst SD-WAN, multiple vulnerabilities related to improper access control (CWE-284) were discovered. A hardened software release addressing these issues has been issued.

Cisco Catalyst SD-WAN contains a vulnerability related to improper input validation (CWE-20). It was discovered during an internal security review and addressed in software hardening releases.