CVE Vulnerability Catalog

FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c.

FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.

A command injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of the LB-LINK router AC1900_AZ2 V1.0.2 via shell metacharacters. It is reachable when an actor can make a POST /goform/set_LimitClient_cfg call but does not already have administrative access to the device.

TinyEXIF before 1.1.0 has a heap-based buffer over-read in EntryParser::Fetch methods reachable via a crafted SubjectArea length. This can lead to reading beyond the bounds of a heap buffer.

Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder. The vulnerability enables unauthorized access to resources outside the intended scope.

A security vulnerability has been detected in GPAC up to f1219cde in the function gf_node_list_add_child of the file scenegraph/base_scenegraph.c of the MP4Box component. The manipulation leads to a null pointer dereference, and the attack can only be performed from a local environment.

Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. The relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content.

Floodlight 71fe8a7 allows disruption of host communication via link spoofing. A port is misclassified as a non-boundary.

A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the Login Success Handler component. Manipulation of the argument geopluginURL causes deserialization, and the attack can be initiated remotely.

A vulnerability was identified in GPAC up to f1219cde in the function gf_sg_mfurl_del of the file scenegraph/vrml_tools.c of the MP4Box component. The manipulation leads to a null pointer dereference, and local access is required to approach this attack.

A vulnerability was found in linlinjava litemall 1.4.0/1.5.0/1.6.0/1.7.0/1.8.0 in the function AdminGoodsService.validate of litemall-vue/src/views/items/detail/index.vue of the Product Detail component. Manipulation of the detail argument leads to cross site scripting and the attack may be launched remotely. The project was informed early but has not responded yet.

A flaw was found in linlinjava litemall 1.5.0/1.6.0/1.7.0/1.8.0 in the function AdminTopicController.validate of litemall-vue/src/views/items/topic/index.vue of the Admin Topic Handler component. Manipulation causes cross site scripting and the attack may be initiated remotely. The project was informed early but has not responded yet.

A vulnerability was detected in moxi624 Mogu Blog v2 up to 5.2 in the function BlogSortServiceImpl.addBlogSort of mogu_web/src/main/resources/templates/info.ftl of the blogSort Endpoint component. Manipulation of the sortName argument results in cross site scripting and the attack can be launched remotely. The project was informed early but has not responded yet.

A security vulnerability was detected in quequnlong shiyi-blog up to 1.2.1 in the function highlightKeyword of blog-web/src/components/Search/index.vue of the Search component. Manipulation of the title/summary argument leads to cross site scripting and the attack can be initiated remotely. The project was informed early through an issue report.

A vulnerability was identified in quequnlong shiyi-blog 1.0.0-1.2.1 in the function SysChatMsgMapper.getChatMsgList of blog-web/src/views/chat/index.vue of the chat sendMsg Endpoint component. Manipulation of the chat_msg argument leads to cross site scripting and the attack may be performed from remote. The project was informed early but has not responded yet.

A vulnerability was found in maliangnansheng bbs-springboot version 3.0.0. It affects the utils.toToc function in ArticleController.java and allows cross site scripting (XSS). The attack can be carried out remotely.

A vulnerability was found in DataEase up to versions 2.10.25/2.10.26. It affects the buildTooltip function in symbolic-map.ts of the Symbolic Map component, where manipulation of the canvasViewInfo[*].customAttr.tooltip.backgroundColor argument leads to cross site scripting (XSS). The attack can be performed remotely, and the project was informed early via an issue report but has not responded.

A flaw was found in TDuckApp tduck-platform up to version 5.3. It affects an unknown functionality in tduck-front/src/views/form/write/index.vue of the Form Write View component, where manipulation of the submitShowCustomPageContent argument causes cross site scripting (XSS). The attack can be carried out remotely, and the project was informed early via an issue report but has not responded.

procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute processes with malicious ANSI or OSC escape sequences in their command line arguments, which are written unmodified to other users' terminals for interpretation by terminal emulators.

joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.