CVE Vulnerability Catalog

VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may cause the product to initiate unintended communication, potentially leading to the leak of sensitive information from the device where the product is installed or resulting in a denial-of-service (DoS) condition.

A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC.

A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.

A flaw was found in bootc when operating with the default containers signature policy. Automatic or manual upgrades of a mutable image tag may apply unsigned content for registries that fall through to insecureAcceptAnything, allowing an attacker who can update that tag to execute arbitrary OS content as the host root filesystem on reboot.

A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

A path traversal vulnerability exists in the View Logs functionality of koozali's SME Server version 11.0rc1-215. An unauthenticated attacker can access files outside the intended directory, leading to exfiltration of potentially sensitive system and application files.

In openGauss-connector-jdbc's LogFactory.java, LogFactory loads the logger class name from JDBC connection parameters via Class.forName, then directly invokes the String constructor and casts to Log. Missing asSubclass(Log.class) validation causes non-Log classes to be instantiated before type checking. When an attacker controls the logger class name in the JDBC URL or connection properties and a loadable class exists on the client classpath, unexpected class loading and constructor side effects may be triggered on the client.

A security vulnerability has been detected in dotnet eShop up to 913acea66708a59595351174cee9b29f37179d29. The affected element is the AddApplicationServices function in src/Catalog.API/Extensions/Extensions.cs of the Catalog API component. The manipulation leads to improper authentication, and the attack can be initiated remotely. The project was informed but has not responded.

In openGauss-server's hll.cpp, the HllObjectUnpack() function has a length validation flaw. After parsing lenUsed and lenTotal from user-supplied packed HLL, it only checks that input length covers HLL_HEAD_SIZE + lenUsed, then allocates a buffer by lenTotal and copies via memcpy_s() by lenUsed, without validating lenTotal >= lenUsed and passing lenUsed instead of lenTotal as destination size. A regular database user can craft a malformed packed HLL (e.g., via ::hll into hll_in()) to trigger a server-side heap overflow.

A vulnerability exists in the Web Server default connection ports under the process name GeoWebServer.exe.

A weakness has been identified in light0011 cms (versions c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930) in App/Home/Controller/UserController.class.php of the Captcha Validation component. The manipulation leads to improper access controls, the attack can be launched remotely, and the exploit is publicly available. The project was informed but has not responded.

A weakness has been identified in kishan0725 Hospital Management System up to 777fda46b77a820977a5ba616283dbfbc40bf7e1. This affects the mysqli_query function of the admin-panel.php file of the Appointment Cancellation Handler component. Manipulation of the ID argument leads to SQL injection. The attack may be launched remotely, and the exploit has been made available to the public.

snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape. A single crafted application/activity+json POST to activitypub_post_handler() is parsed before signature checks, overflowing heap allocations and crashing the server.

cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_accessor_unpack_floats() that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Supplying a crafted glTF or GLB file with large sparse indices can corrupt heap memory, crash applications, and potentially execute code when cgltf_validate() is not called.

Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting os_env.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only validation in bundles.py, to read and write host files as the runner user.

WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files.

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.

Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and acknowledge its events, starve the legitimate consumer, and enumerate cluster users via ListUser.

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/{ns}/eventbus/{name}/events or legacy /gateway/{name} paths, bypassing token authentication and authPublish checks, so they are stored and delivered to subscription sinks.

The PowerPack Lite for Beaver Builder plugin (up to version 1.3.1) is vulnerable to stored XSS due to improper neutralization of input during web page generation. An attacker can inject a malicious script that gets stored and executed.