CVE Vulnerability Catalog

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to the ability to disable server-side input validation via a request parameter.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization using user-supplied input.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to external control of system configuration.

ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via undoHtmlSpecialChars() before passing it to eval() in the renderWithPhp() method, bypassing HTML Purifier sanitization, and the payload is triggered on every frontend page load through the preload event system.

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability. An unauthenticated attacker can submit crafted prompts to the POST /api/v1/responses/ endpoint, which reaches the Anton agent's scratchpad tool that calls exec() on Python code without sandboxing.

js-toml, a TOML parser for JavaScript, before version 1.1.2 contains a vulnerability due to incorrect duplicate key checking. Instead of checking `if (key in object)`, it uses `if (object[key])`, causing that when the previous value is falsy (e.g., `false`, `0`, `""`), the duplicate key branch is skipped and the value is silently overwritten. This leads to structural type confusion in the returned object.

mcp-memory-service before version 10.67.1 serves all HTTP routes under /api/documents/* without any authentication dependency, even when configured with an API key or OAuth. An unauthenticated attacker can upload, retrieve, and permanently delete data from the memory store.

erlang_quic before version 1.4.4 did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the certificate chain was not validated, and the hostname was not compared against the certificate, making verification ineffective.

Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the copydir() function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. copydir() is a utility function called when a file operation crosses a device boundary inside an AFP shared volume, which the standard library's renameat() cannot handle. The function attempts to track available buffer space using srem and drem for source and destination paths. Incorrect arithmetic causes both srem and drem to underflow to SIZE_MAX. Consequently, boundary checks against strlen(de->d_name) always pass, allowing strcpy() to append filenames into nearly full stack buffers. Version 4.4.3 patches the issue. As a workaround, configure each AFP shared volume to be structured as a single file system, in other words no subdirectory of a shared volume should be a mount point for a different file system.

A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the OS, allowing arbitrary command execution with root privileges.

LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database (CPDB) workflow that copies survey participant tokens to the central participant list.

The vulnerability allows an authenticated user with "DNA Authority - Operator" privilege to tamper with serialized data, potentially leading to code execution during deserialization under the privileges of the "DNA Apps" security group.

Emlog is an open source website building system. In 2.6.20 and earlier, there is a SQL injection vulnerability in the queryDatabase function in ai.php.

Emlog version 2.6.26 and earlier allows unauthenticated reinstallation (action=reinstall) in install.php, which skips the already-installed check. An attacker can overwrite config.php and create a new administrator account.

Missing CSRF protection in the execute_tool action in admin/ai.php in Emlog 2.6.26 and earlier allows a remote unauthenticated attacker to submit a forged request to a logged-in administrator. The attack can read all database tables and write to all tables except blog, including taking over an administrator account.

Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding.

In Capstone before version 6.0.0-Alpha9, the public cs_insn_name() API forwards instruction IDs to M68K and RISCV backends without proper bounds checks, potentially causing an out-of-bounds read and process crash.