CVE Vulnerability Catalog

OCS Inventory NG Server version 2.12.3 and prior contain a stored cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript by submitting malicious User-Agent HTTP headers to the /ocsinventory endpoint. Attackers can register rogue agents or craft requests with malicious User-Agent values that are stored without sanitization and rendered with insufficient encoding in the web console, leading to arbitrary JavaScript execution in the browsers of authenticated users viewing the statistics dashboard.

In the importWrappedKey function in KMKeymasterApplet.java, there is a vulnerability that allows access to keys that should be restricted due to improper input validation. This could lead to local information disclosure without the need for additional execution privileges. User interaction is not required for exploitation.

An information disclosure vulnerability in AZIOT 1 Node Smart Switch (16A) with firmware version 1.1.9 is caused by improper access control on the UART debug interface. An attacker with physical access can connect to the UART interface and obtain sensitive information from the serial console without authentication.

An authenticated stored XSS vulnerability exists in the creation/editing module of Feehi CMS v2.1.1. Attackers can inject malicious JavaScript or HTML into the Content field, which executes in other users' browsers.

A DoS vulnerability in vLLM from version 0.1.0 to before 0.19.0 allows an unauthenticated attacker to block the asyncio event loop and cause Out-Of-Memory crashes by sending a single HTTP request with an astronomically large n parameter in ChatCompletionRequest and CompletionRequest models.

A vulnerability in vLLM from version 0.7.0 to before 0.19.0 allows an attacker to send a single API request with thousands of base64-encoded JPEG frames, causing the server to decode all frames into memory and crash with OOM. The issue is due to missing frame count limit in the VideoMediaIO.load_base64() method.

In OpenEXR versions 3.2.0 to 3.2.7, 3.3.9, and 3.4.9, a vulnerability exists in the DWA lossy decoder. For sufficiently large image widths, 32-bit arithmetic overflow causes writes outside the allocated rowBlock buffer.

A race condition during TCP connection teardown causes tcp_recv() to operate on a released connection. When tcp_conn_search() returns NULL while processing a SYN packet, a NULL pointer from stale context is passed to tcp_backlog_is_full() and dereferenced without validation, leading to a crash.

A vulnerability has been found in Ollama up to version 0.18.1 in the Model Pull API component, specifically in the file server/download.go. It allows remote attackers to perform a Server-Side Request Forgery (SSRF) attack through manipulation of an unknown process.

Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms. Attackers can trick authenticated administrators into submitting requests to admin/user_manipulate and admin/settings/generall endpoints to create users or modify application settings without explicit consent.

MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Attackers can add crafted HTML and JavaScript payloads in the comment field that execute when other users view or edit the comment.

The MyBB Like Plugin version 3.0.0 contains a stored cross-site scripting vulnerability. Authenticated attackers can inject malicious scripts into post or thread subjects, which are rendered unsanitized when viewing a profile displaying liked posts.

Eco Search 1.0.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string to the search functionality. Attackers can paste a buffer of 950 or more characters into the search bar and trigger a crash by initiating a search operation.

FastTube 1.0.1.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string to the search functionality. Attackers can paste a buffer of 1900 characters into the search bar and trigger a crash when the search operation is executed.

One Search 1.1.0.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting excessively long input strings to the search functionality. Attackers can paste a buffer of 950 or more characters into the search bar to trigger an unhandled exception that crashes the application.

Watchr 1.1.0.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string to the search functionality. Attackers can paste a buffer of 8145 characters into the search bar and trigger a search operation to cause the application to crash.

Smart VPN 1.1.3.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input through the search interface. Attackers can paste a buffer of 2100 characters into the top right search bar to trigger an unhandled exception that crashes the application.

VSCO version 1.1.1.0 contains a denial of service vulnerability that allows local attackers to crash the application by pasting a 5000-character string into the search bar and navigating back.

Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft HTML forms targeting the users endpoint with hidden fields containing admin credentials and account parameters to add new administrator accounts without user consent.

Snews CMS 1.7 contains a cross-site request forgery vulnerability that allows attackers to change administrator credentials without authentication by crafting malicious HTML forms. Attackers can trick authenticated administrators into visiting a page containing a hidden form that submits POST requests to the changeup action, modifying the admin username and password parameters to gain unauthorized access.