CVE Vulnerability Catalog

Consul Community Edition and Consul Enterprise versions 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplete connections.

Ruby JSON versions 2.20.0 through 2.21.2 have a heap-use-after-free vulnerability in the native C extension. After consuming the input buffer of JSON::ResumableParser, state pointers remain pointing to released storage, and when partial_value reconstructs an incomplete object with duplicate keys, the duplicate-key warning path dereferences stale pointers, potentially terminating the Ruby process.

NexTor IP Changer before version 2.0.0 executes privileged system commands using `sudo` and `shell=True` directly inside application logic. In environments where passwordless sudo (NOPASSWD) is enabled, privileged commands may execute silently without explicit user confirmation.

NexTor IP Changer before version 2.0.0 has a command execution vulnerability due to unsafe use of `shell=True` with commands that rely on executable resolution through the PATH environment variable. An attacker controlling the execution environment can place malicious executables earlier in the PATH, resulting in execution of attacker-controlled code.

SourceCodester Simple Doctors Appointment System 1.0 has a SQL injection vulnerability in the file /admin/ajax.php?action=delete_appointment. Manipulation of the argument ID results in SQL injection, which can be launched remotely.

Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, token validation is skipped, allowing an unauthenticated remote attacker to trigger the operator's already-configured scheduled jobs.

Injection of false emergency or status messages over CPDLC may lead to misallocation of resources, operational confusion, and improper response actions by flight crews, traffic controllers, and ground operations. This type of attack can be carried out remotely over radio frequency.

Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages leading to unexpected or misleading clearances and potential pilot confusion. This type of attack can be carried out remotely over radio frequency.

In sol commit 373d848 (2024-12-12), the broker does not fully release resources when handling malformed or duplicate CONNECT packets. When clients send invalid CONNECT packets, the server may silently drop the connection or send a CONNACK but fail to close the session or deallocate internal resources. This allows an attacker to create numerous half-open connections that consume memory and file descriptors indefinitely, potentially triggering the Linux OOM killer and causing a denial of service.

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website, it is possible to escalate to RCE, but requires social engineering and explicit interaction by the victim. This issue affects all versions of WordPress; version 7.0.3 has been released with a fix, backported to all branches back to 4.7.

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database.

Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags. An attacker can supply an image with such an entry, leading to heap data leakage into the exif_* tag.

go-git prior to versions 5.19.2 and 6.0.0-alpha.5 has a vulnerability where worktree operations (checkout, status, add) resolve symbolic links without confining resolution to the worktree boundary. A maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory.

ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attackers with write access to a shared artifact store to execute arbitrary code by planting a malicious pickle file. Attackers can replace a stored artifact.pkl file with a crafted cloudpickle payload containing a malicious __reduce__ method, which executes arbitrary system commands when any user or pipeline materializes the artifact.

In absinthe_federation from 0.1.0 before 0.9.3, there is a vulnerability of allocation of resources without limits, allowing an unauthenticated remote attacker to abort the Erlang VM via crafted _entities representation keys. Every key of every object in the representations argument is converted with String.to_atom/1, and atoms are never garbage collected, leading to exhaustion of the atom table and node crash.

A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption. This is due to improper boundary checks for content in XAR files during scanning.

A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption. This is due to improper boundary checks, which may result in an out-of-bounds buffer read.

A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption. This is due to improper boundary checks, which may result in an out-of-bounds buffer read.

A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption. This is due to improper handling of an endian conversion operation, which may result in an out-of-bounds buffer write.

A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other impacts due to memory corruption. The issue is caused by improper boundary checks in PESpin files during scanning, which may result in an integer overflow. An attacker could exploit this by submitting a crafted file with PESpin content to be scanned by ClamAV.