CVE Vulnerability Catalog

An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the UA_Client_getRemoteDataTypes component.

open62541 version 1.5.5 contains a heap-based buffer overflow in the default HistoryRead path when the default history database is used with the memory backend.

Buffer overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via Discovery/LDS handling.

Buffer overflow vulnerability in open62541 1.5.5 when the Local Discovery Server (LDS) is built with multicast discovery enabled through the MDNSD backend. An unauthenticated remote attacker can send a RegisterServer or RegisterServer2 request containing many unique discoveryUrls, causing a denial of service.

open62541 1.5.5 contains an out-of-bounds read in the client-side function responseReadNamespacesArray() in src/client/ua_client_connect.c.

A vulnerability in open62541 version 1.5.5 and earlier allows a remote attacker to cause a denial of service via crafted CreateSubscription, CreateMonitoredItems(Sampling), Publish, TransferSubscriptions, and DeleteSubscriptions requests.

open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UA_ENABLE_GDS_PUSHMANAGEMENT is enabled. This allows a remote attacker to cause a denial of service.

In OpenSIPS prior to versions 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. An attacker can send a Content-Length value that overflows (e.g., 4294967296), causing the framing layer to compute a wrapped-around value and split the TCP stream at the wrong boundary, enabling SIP message smuggling. Because Content-Length is parsed before authentication, an unauthenticated attacker can smuggle arbitrary SIP messages over any TCP-based transport.

In OpenSIPS versions 3.4.0 through 3.6.5, there is a denial of service vulnerability in the presence module. The handle_publish() function processes a SIP PUBLISH request with an Event: presence header and a message body while enable_sphere_check=1, invoking get_content_type() without first calling parse_content_type_hdr(), causing a crash due to dereferencing uninitialized or NULL Content-Type parsing state. A remote attacker can cause a denial of service with a single PUBLISH request over UDP or TCP.

A vulnerability was found in H3C NX15 V100R017 affecting the function reload.reload_config in the file /api/esps. The manipulation results in command injection. The attack can be launched remotely, and the exploit has been made public.

In Open WebUI from 0.10.0 until 0.11.0, the DELETE /api/v1/folders/{id} handler allowed a user with write access to a shared chat folder to permanently delete chats and messages belonging to the folder owner. The authorization check did not require ownership or administrator status, and the cascade was bound to the owner's id. A collaborator can destroy the owner's subtree or force-move chats out of it.

In Open WebUI from 0.10.0 until 0.11.0, the KatexRenderer.svelte component could store and render a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. The catch branch inserted the original math source into the page as HTML through {@html}, allowing script execution in the browser of anyone who views the message, including shared chats and channels. The viewer's session token can be stolen, and an administrator viewer can have their account taken over.

Vulnerability in Google::Auth for Perl before version 0.09 allows SSRF and credential exfiltration. URLs taken from the credentials JSON are not validated against the universe domain, enabling requests to internal services and link-local endpoints with application credentials.

In CVAT versions 2.5.0 through 2.66.0, there is an XSS vulnerability accessible through annotation guide assets. When CVAT serves files attached to an annotation guide, it labels them with a media type that the attacker can influence, allowing the victim's browser to treat the file as an HTML page and run any JavaScript inside it. This issue has been fixed in version 2.67.0.

In Vim Project version 9.2.0389 and earlier, there is an issue in the vms_fixfilename() function in vim/src/os_vms.c that allows a local attacker to execute arbitrary code.

Vim version 9.2.0389 and earlier has a vulnerability that allows a local attacker to execute arbitrary code via the vms_fixfilename() function in file vim/src/os_vms.c.

A vulnerability has been found in H3C NX15 V100R017 affecting the function delete in the file /api/esps. Manipulation of the argument esps.apcm.version leads to command injection. The attack can be initiated remotely, and the exploit has been disclosed to the public.

A flaw has been found in H3C NX15 V100R017 affecting the function esps.ipv6.wan in the file /api/esps. Executing a manipulation of the argument workMode can lead to command injection. The attack can be launched remotely, and the exploit has been published.

A vulnerability was detected in H3C NX15 V100R017 affecting the function Add in the file /api/esps. Performing a manipulation of the argument esps.filter.url results in command injection. The attack can be initiated remotely, and the exploit is now public.

In ERPNext versions before 16.25.0 and before 15.115.0, there is an Improper Authorization vulnerability in the whitelisted API method erpnext.crm.doctype.prospect.prospect.get_opportunities. Insufficient access control allows unauthorized users to access data.