CVE Vulnerability Catalog

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe, exhausting file descriptors, memory, and goroutines.

FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory.

FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStream_New that allows malicious RDP servers to trigger invalid memory reads via short clipboard responses. Attackers can answer a FILECONTENTS_SIZE request with a cbRequested of fewer than eight bytes when a user pastes a remote file.

FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client. A malicious RDP server can send a non-NUL-terminated window title, causing heap over-reads, title corruption, or client crashes.

FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client. A malicious RDP server can request unadvertised camera media types by sending a StartStreamsRequest with oversized dimensions, forcing large allocations and reconfiguring the local camera via the HAL.

FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport. A malicious gateway can send zero-length pings, causing a nullptr stream to be passed to websocket_reply_close and crashing the client.

Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52 contains a vulnerability in the session.get_modelmeta.custom_metadata_map function in ultralytics/nn/autobackend.py. Manipulation of the imgsz/names/kpt_shape arguments leads to improper neutralization of directives in dynamically evaluated code, requiring local access.

ImprintLab Medical-SAM-Adapter 0.1.0-alpha/0.1.0 contains a vulnerability in the session.get_modelmeta.custom_metadata_map function in models/MobileSAMv2/ultralytics/nn/autobackend.py. Manipulation of the imgsz/names/kpt_shape arguments leads to improper neutralization of directives in dynamically evaluated code, requiring local access. The exploit is publicly available.

A missing authorization vulnerability exists in the internal API /api/v1/secrets/ of some Moxa industrial computing products. A low-privileged authenticated attacker with adjacent network access could access sensitive information, including cryptographic key material.

The Popup Box plugin for WordPress versions 6.4.1 to 6.4.2 is vulnerable to Arbitrary Shortcode Execution. The ays_popup_get_user_ip() function reads client-controlled headers, sanitizes them only with sanitize_text_field(), substitutes the value into popup body where %%user_ip_address%% token appears, and passes the result to do_shortcode(), allowing unauthenticated attackers to execute arbitrary registered shortcodes.

A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code.

A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver. A local authenticated user could cause a blue screen error.

A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.

A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an unauthorized remote user to disclose sensitive information.

A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.

The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but KeycloakJWTMiddleware then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected.

The Apache Airflow SFTP provider's deferrable code paths (SFTPTrigger, SFTPHookAsync, SFTPClientPool) disable SSH host-key verification by default unless the connection explicitly sets no_host_key_check to false. Deployments that run SFTP sensors or operators in deferrable mode are affected.

The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments enabling multi-team mode with the Keycloak auth manager are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API.

ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE handlers to overwrite answers, grades, feedback, and grading status or delete submissions.

BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribe_new, or /api/subscribe/confirm to deactivate any contact or force confirmed subscriptions.