CVE Vulnerability Catalog

A flaw in FreeIPA allows a remote unauthenticated attacker to exploit the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body, causing excessive memory consumption, memory exhaustion, and denial of service.

A flaw in FreeIPA allows a remote unauthenticated attacker to send oversized form POST requests to `/ipa/migration/migration.py`, forcing the migration handler to read attacker-controlled bodies fully into memory, leading to increased memory usage, slower handling, and potential DoS.

FreeIPA has a vulnerability due to lack of size limits for OTP key values. A low-privilege authenticated user can submit an oversized OTP key, causing excessive CPU and memory consumption, leading to denial of service.

A privilege escalation flaw was found in FreeIPA. The uniqueness constraint on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations, allowing a user with LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets and potential full domain compromise.

A flaw was found in FreeIPA. When a trust relationship is configured with Active Directory, AD users can bypass authentication for FreeIPA services by impersonating a client name in the TGS due to missing PAC certificate verification. This could allow an authenticated AD user to escalate privileges within the FreeIPA domain.

A flaw in libvirt allows an unprivileged local user to exploit an integer overflow in the NodeGetFreePages RPC handler, bypassing a size check and leading to a heap buffer overflow. This can corrupt the root libvirt daemon's memory, potentially causing DoS or local privilege escalation.

In libsoup, in SoupServer's HTTP Range header processing, the sort_ranges() comparator truncates a 64-bit subtraction result to 32-bit int, causing incorrect sorting for ranges on files larger than ~2 GB. This leads to omission of requested ranges in HTTP 206 Partial Content responses.

In the Zoo extension for Joomla (versions < 4.1.65), the comment controller endpoint lacks ACL checks, allowing unauthenticated users to modify tags without authorization.

A low-privileged remote attacker can enumerate all configured users and identify accounts with elevated privileges using the endpoint /api/user/fetch-all.php.

An unauthenticated remote attacker can retrieve sensitive files from the FDS Web server, such as the backup archive at `/FdsBackup.zip` and files under `/downloads/*`, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information.

A low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages.

An unauthenticated remote attacker with a valid session identifier can continue using the session after expiration. This increases risks associated with stolen or shared sessions and may enable unauthorized continued access to the FDS web interface.

A low-privileged remote attacker with a valid session can create new user accounts with arbitrary role values, including the highest privilege level, using the /api/user/add.php endpoint.

A low-privileged remote attacker can hijack an active administrative session without knowing the admin password by extracting plaintext session identifiers from downloadable error logs.

A high-privileged remote attacker can upload a malicious ZIP with directory traversal sequences, escaping the extraction directory and writing files to arbitrary locations, potentially achieving code execution.

A high-privileged remote attacker can upload a .php file and request it directly from /uploads to achieve arbitrary code execution due to improper file type validation.

The Joomla extension Phoca Download versions 5.0.0-6.1.4 contains a Reflected XSS vulnerability via the 'search' GET parameter.

The Joomla extension Phoca Cart versions 5.0.0-6.1.7 contains a Reflected XSS vulnerability via the 'price_from' and 'price_to' filter parameters.

Joomla extension Phoca Cart 5.0.0-6.1.7 has a stored XSS vulnerability via User-Agent header in the admin order view.

Joomla extension iCagenda 4.0.8 to 4.0.12 has an authenticated stored XSS in the 'Submit an Event' form, where image and file fields are stored without output-side HTML-attribute escaping.