CVE Vulnerability Catalog

IBM i versions 7.6, 7.5, 7.4, and 7.3 contain a stack-based buffer overflow vulnerability that could allow a remote attacker to cause a denial of service and potentially obtain sensitive information.

IBM i versions 7.6, 7.5, 7.4, and 7.3 contain an improper privilege management vulnerability that could allow a remote authenticated attacker to obtain unauthorized privileges.

IBM Documentation Offline versions 1.0.0 through 1.4.1 may allow a remote attacker to obtain sensitive information due to a security misconfiguration where the documentation server binds to an unrestricted IP address.

IBM i versions 7.6, 7.5, 7.4, and 7.3 may allow a remote authenticated attacker to cause a denial of service due to a stack-based buffer overflow.

IBM i versions 7.6, 7.5, 7.4, and 7.3 contain an untrusted search path vulnerability that could allow a remote authenticated attacker to execute arbitrary code.

IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 are vulnerable to arbitrary code execution on Windows when installed for all users due to a publicly writeable directory.

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled.

IBM Storage Scale versions 5.2.3.0 through 5.2.3.8 and 6.0.0.0 through 6.0.1.0 contain a hardcoded token in the GUI source code, used for inter-node cluster communication and REST API authentication between GUIs.

IBM Planning Analytics 2.0 and 2.1 Local is vulnerable to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled.

Vitest Browser Mode before versions 3.2.7, 4.1.10, and 5.0.0-beta.6 does not enforce the allowWrite permission gate or confine paths to the project root for commands such as upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces. A client that can reach the Browser Mode API can read arbitrary local files, create or overwrite image and trace files, or delete files accessible to the Vitest process even when allowWrite is false. This issue is fixed in versions 3.2.7, 4.1.10, and 5.0.0-beta.6.

vantage6 version 5.0.2 and earlier has an algorithm-store edit permission lacking an ownership check, allowing one algorithm developer to alter another developer's algorithm while it is pending or under review. The attacker can change metadata including the algorithm image or image tag, causing reviewers and nodes to trust a different image from the one originally submitted. No fixed version is available as of this review.

TypeORM prior to versions 0.3.31 and 1.1.0 contains a vulnerability in the migration:generate command that embeds database schema metadata into JavaScript or TypeScript template literals, escaping backticks but not ${...} interpolation. An attacker with database schema write access can place a payload in column COMMENT or DEFAULT metadata, or another introspected schema string, and the JavaScript engine evaluates the payload when the generated migration is loaded.

SVGO (SVG Optimizer) is a Node.js library and CLI for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin (removeScriptElement in versions 1-3) can leave executable content in optimized SVGs because it does not remove namespaced or prefixed script elements such as <svg:script> and, in versions 3 and 4, matches JavaScript URIs case sensitively. Applications processing untrusted SVG input with this plugin enabled and serving the result can allow scripts to execute when another user opens the SVG, exposing local storage or cookies. Fixed in versions 2.8.3, 3.3.4, and 4.0.2.

phpList before 3.7.0-RC5 contains a CSRF vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request (?page=admins&delete=N) that is not protected by a CSRF token (the central verifyCsrfGetToken check uses enforce=false and is bypassed when the token parameter is absent). A remote attacker can trick a logged-in super-administrator into loading a crafted URL (e.g., embedded as an image in an email) to delete any non-self administrator account.

phpList before 3.7.0-RC5 fails to enforce CSRF token validation on the bounce rule deletion endpoint (bouncerules.php / bouncerule.php). The deletion is performed via a GET request (?page=bouncerules&del=N), and the central CSRF check (verifyCsrfGetToken) is invoked with enforce=false, so it only validates the token when a 'tk' parameter is present. A remote attacker can trick an authenticated administrator into loading a crafted URL (e.g., embedded in an image tag) to delete arbitrary bounce rules from the phplist_bounceregex table without a valid CSRF token.

NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and tag.name attributes. Attackers can deliver malicious ActivityPub Create/Note objects with crafted emoji tags to inject arbitrary HTML and JavaScript into stored post content, executing code in all viewers' browsers.

Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the localhost origin, enabling exfiltration of diagram sessions and API data.

Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to internal addresses, allowing them to reach arbitrary internal HTTP services and exfiltrate responses including cloud metadata.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper privilege management.