CVE Vulnerability Catalog

Buffer Overflow vulnerability in zserge jsmn jsmn HEAD 25647e6 allows a remote attacker to cause a denial of service via the jsmn.h, jsmn_parse(), example/jsondump.c, dump() components

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to trigger an out-of-bounds memory read.

SFTPGo prior to 2.7.5 allows an authenticated SSH user to send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or integrity impact has been identified.

A vulnerability in MediaAgent (part of Commvault) involves a heap-based buffer overflow affecting service availability. Customers are advised to upgrade to the resolved maintenance release.

CVFS contained an input validation issue affecting command execution. Software customers should upgrade to the resolved maintenance release.

A vulnerability in CVFS (part of Commvault) involves a missing authentication condition affecting command execution. Customers are advised to upgrade to the resolved maintenance release.

CvFWD contained a null pointer dereference affecting service availability. The vendor recommends upgrading to the resolved maintenance release.

CvFWD contained an out-of-bounds write affecting service availability. The vendor recommends upgrading to the resolved maintenance release.

CvFWD contained an integer overflow affecting service availability. The vendor recommends upgrading to the resolved maintenance release.

CVFS contained an XML external entity (XXE) reference handling issue affecting information disclosure. The vendor recommends upgrading to the resolved maintenance release.

The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport libraries subtract a fixed header or reserved-field size from a device-supplied response length without a lower-bound check. An undersized response wraps the unsigned length difference to a very large value, and the parser then reads far past the response buffer. The affected code sits in the base PLDM control class and the Huawei NCSI driver, so it is reachable for any PLDM endpoint or Huawei NIC on the internal management bus.

openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated but low-privilege SNMP user can invoke mapped backend operations as an administrative identity. In route_mapper/account.lua, get_user_privilege returns the complete nine-privilege set for a special_users group that includes the SNMPv1_v2c pseudo-user.

Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The keys are shipped constants, not per-unit values, and are not rotated by the Administrator password reset, so they survive account provisioning.

H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`. That file is writable by an authenticated Redfish client through the `UpdateService.UploadSignKey` action, which stores the uploaded body verbatim after validating only that the multipart filename ends in `.pem`. An administrator, or any account with `firmware-update` privilege, can therefore replace the trust anchor with their own key, sign a malicious image with the matching private key, and have it pass verification. Family-A has no hardware root-of-trust (no PFR) to catch the substituted key.

MCP Context Forge versions 0.2.0 through 0.3.1 store a prompt template without sufficient output encoding before rendering in the MCP Admin UI. An authenticated attacker can save markup with script-capable event handlers that execute when another user views the saved prompt. This enables stored XSS, interface alteration, phishing, keystroke observation, and actions in the victim's browser session.

MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() creates a platform administrator when the token subject matches PLATFORM_ADMIN_EMAIL and REQUIRE_USER_IN_DB is false. A remote unauthenticated attacker can therefore mint accepted administrator tokens without a database account. While the vulnerable signing key remains configured and the platform-admin bootstrap remains enabled, forged access survives password rotation, account deletion, and session revocation, allowing administrative disclosure, modification, and service disruption.

Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct an escalation of privilege via network access.

Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege via network access.

InstallShield version 2025 R2 and earlier has a potential privilege escalation issue when running a compressed Basic MSI setup with Prerequisites from an insecure location. If a local administrator launches Setup.exe with Prerequisites from an unsecured location, the Prerequisite installers may also load from an unsecured location, potentially leading to privilege escalation.