CVE Vulnerability Catalog

Version 3.0.0 of the Jerryscript project contains a vulnerability that allows an attacker to obtain sensitive information via a crafted script related to arrays.

In versions before 0.3.1 of the ai-dev aicombinationsonfly library, a SQL injection vulnerability was discovered in the /includes/ajax.php component.

Memory management and protection issues in Bitcoin Core v22 allow attackers to modify the stored sending address within the app's memory, potentially enabling them to redirect Bitcoin transactions to wallets of their own choosing.

PiiGAB M-Bus is vulnerable to cross-site request forgery (CSRF). An attacker can send a phishing email to the device owner, hoping they will click on a link, which could result in unauthorized command execution.

The lack of requirements for setting complex passwords in PiiGAB M-Bus may lead to successful brute force attacks if the password aligns with recommended password guidelines.

PiiGAB M-Bus stores passwords using a weak hash algorithm, which may lead to easy cracking.

PiiGAB M-Bus SoftwarePack 900S does not correctly sanitize user input, which could allow an attacker to inject arbitrary commands.

Mastodon, an ActivityPub-based social network server, is vulnerable to slowloris-type attacks that can lead to server unresponsiveness. In versions prior to 3.5.9, 4.0.5, and 4.1.3, a malicious server can indefinitely extend the response time, keeping all Mastodon workers busy for an extended duration.

In versions prior to 2023.4.3 and 2023.5.5, authentik does not verify the source of the X-Forwarded-For and X-Real-IP headers, which may lead to IP address spoofing in logs and downstream applications. Only authentik setups directly accessible by users are susceptible to this vulnerability.

In the league/oauth2-server library, versions 8.3.2 to 8.5.3, keys passed to the CryptKey constructor as a string instead of a file path could be exposed in a LogicException message if a valid passphrase was not provided. This issue has been patched in version 8.5.3.

Sanitize is an HTML and CSS sanitizer that in versions from 3.0.0 to 6.0.2 may be vulnerable to injection of malicious HTML and CSS. An attacker can exploit carefully crafted input to introduce unauthorized code, potentially leading to cross-site scripting attacks.

File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obtain sensitive information via the ClientUploader function.

CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function.

A SQL Injection vulnerability detected in Food Ordering System v1.0 allows attackers to run commands on the database by sending crafted SQL queries to the ID parameter.

SQL injection vulnerability in langchain before v0.0.247 allows a remote attacker to obtain sensitive information via the SQLDatabaseChain component.

There is an input verification vulnerability in the WMS API. Successful exploitation of this vulnerability may cause the device to restart.

There is a format string vulnerability in the distributed file system. Attackers who bypass SELinux permissions can exploit this vulnerability to crash the program.

Vulnerability related to incomplete input parameter verification in the communication framework module. Successful exploitation of this vulnerability may affect system availability.

An Out-of-bounds Read vulnerability exists in the GitHub repository gpac/gpac prior to version 2.2.2.

Fides is an open-source privacy engineering platform with a path traversal vulnerability in versions below 2.15.1. This allows remote attackers to access arbitrary files on the Fides webserver container's filesystem.