CVE Vulnerability Catalog

OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTE_FRAMES. Attackers can craft methods that make the unbounded MethodWriter.computeAllFrames() fix point algorithm converge slowly, tying up transforming threads for unbounded time.

OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() when using COMPUTE_MAXS or COMPUTE_FRAMES. Attackers can supply a crafted class file with thousands of overlapping exception handlers, causing excessive Edge allocations and an OutOfMemoryError that crashes the JVM.

OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions() that allows attackers to cause denial of service through crafted class files. Attackers can supply a class with a large method containing many long forward jumps, triggering unbounded toByteArray() recursion and a StackOverflowError during transformation.

OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors() that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted invalid class file with multiple RET instructions for one JSR, triggering a roughly 2 GB allocation that crashes the JVM.

OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute() that sizes an int array from num_bootstrap_methods without validating attribute_length. Attackers can supply a crafted class file of about 100 bytes that forces roughly 2 GB allocation, causing an OutOfMemoryError that crashes the JVM or consuming thread.

svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences() in src/ElementReference/Resolver.php builds the SVG <use> reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes() normalizes mixed-case names. An attacker can provide xlink:HrEf on nested <use> elements so the graph omits those references, after which the sanitizer converts the attribute to canonical xlink:href and returns the live nesting structure without applying the useNestingLimit protection. A consuming application that renders the sanitized SVG can therefore be exposed to the resource exhaustion that control is designed to prevent. This issue is fixed in version 1.0.0.

NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with malformed XML and can cause unbounded memory growth in long-lived NGINX worker processes.

The njs XML module in NGINX JavaScript (njs) exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference, and the $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker to skip validation while signature verification succeeds.

L-SMASH through 2.14.5 contains an infinite loop vulnerability in vc1_importer_probe() in importer/vc1_imp.c. Attackers can supply a file consisting only of zero bytes, which lsmash_read_file() probes automatically, causing indefinite CPU consumption and denial of service.

Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. A low privileged attacker with local access could potentially exploit this vulnerability, leading to denial of service.

Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Restrictive Account Lockout Mechanism vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint. Attackers can bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in the default configuration, causing the server to fetch and proxy back arbitrary private-network and cloud metadata content.

7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp). Attackers can leak heap memory by crafting a malicious archive where the superblock's no_ids field is set so that the final metadata block's expected size is miscomputed and bypasses the size validation check. By listing or extracting the crafted archive, attackers can cause the application to return uninitialized heap memory as the kpidUserId and kpidGroupId properties.

Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) a Path Traversal vulnerability due to improper limitation of a pathname to a restricted directory. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information disclosure.

Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) a Command Injection vulnerability due to improper neutralization of special elements used in a command. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to remote execution.

Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an OS Command Injection vulnerability due to improper neutralization of special elements used in an OS command. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to remote execution.

A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local attacker can read the log file to obtain the LUKS passphrase.

The WP OAuth Server plugin (miniOrange) in versions up to 6.4.0 contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The Bus Ticket Booking with Seat Reservation plugin (Magepeople inc.) in versions up to 5.9.7 contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The WP w3all phpBB plugin (axew3.com) in versions up to 3.1.0 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation.