CVE Vulnerability Catalog

The MyBB Like Plugin version 3.0.0 contains a stored cross-site scripting vulnerability. Authenticated attackers can inject malicious scripts into post or thread subjects, which are rendered unsanitized when viewing a profile displaying liked posts.

Eco Search 1.0.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string to the search functionality. Attackers can paste a buffer of 950 or more characters into the search bar and trigger a crash by initiating a search operation.

FastTube 1.0.1.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string to the search functionality. Attackers can paste a buffer of 1900 characters into the search bar and trigger a crash when the search operation is executed.

One Search 1.1.0.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting excessively long input strings to the search functionality. Attackers can paste a buffer of 950 or more characters into the search bar to trigger an unhandled exception that crashes the application.

Watchr 1.1.0.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string to the search functionality. Attackers can paste a buffer of 8145 characters into the search bar and trigger a search operation to cause the application to crash.

Smart VPN 1.1.3.0 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input through the search interface. Attackers can paste a buffer of 2100 characters into the top right search bar to trigger an unhandled exception that crashes the application.

VSCO version 1.1.1.0 contains a denial of service vulnerability that allows local attackers to crash the application by pasting a 5000-character string into the search bar and navigating back.

Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft HTML forms targeting the users endpoint with hidden fields containing admin credentials and account parameters to add new administrator accounts without user consent.

Snews CMS 1.7 contains a cross-site request forgery vulnerability that allows attackers to change administrator credentials without authentication by crafting malicious HTML forms. Attackers can trick authenticated administrators into visiting a page containing a hidden form that submits POST requests to the changeup action, modifying the admin username and password parameters to gain unauthorized access.

A buffer overflow vulnerability exists in NetSchedScan 1.0 in the Hostname/IP field. A local attacker can supply a crafted payload of 388 bytes followed by a 4-byte EIP overwrite, causing the application to crash.

The Kadence Blocks plugin for WordPress up to version 3.6.3 has an authorization bypass in the process_pattern REST API endpoint, which does not properly verify the upload_files capability. Authenticated attackers with contributor level access or above can upload images to the Media Library by supplying remote image URLs.

Hirschmann HiLCOS products (OpenBAT, BAT450, WLC, BAT867) have a firewall filtering vulnerability that fails to correctly filter IPv4 multicast and broadcast traffic when management IP address filtering is disabled, allowing configured filter rules to be bypassed.

In OpenPrinting CUPS versions 2.4.16 and prior, the RSS notifier allows path traversal in notify-recipient-uri, enabling a remote IPP client to write RSS XML bytes outside CacheDir/rss to any lp-writable location. By exploiting default group-writable permissions (root:lp, mode 0770), the notifier running as lp can overwrite root-managed state files, causing job cache parsing failures and loss of queued jobs after cupsd restart.

The vulnerability in prompts.chat prior to commit 1464475 allows authenticated users to perform blind server-side request forgery (SSRF) via the inputImageUrl parameter in the Wiro media generator. Attackers can send POST requests to the /api/media-generate endpoint to probe internal networks, access internal services, and exfiltrate data through the upstream Wiro service.

A weakness has been identified in BookStackApp BookStack up to version 26.03 in the chapterToMarkdown function of app/Exports/ExportFormatter.php (Chapter Export Handler). Manipulating the pages argument can lead to improper access controls. The attack can be launched remotely and the exploit is publicly available.

In the Linux kernel, the atmel-sha204a driver has a ->tfm_count leak when memory allocation fails. The counter is not decremented, potentially blocking future read operations.

In the Linux kernel, a vulnerability was found in the SPI statistics allocation. Per-CPU statistics were not allocated before controller registration, allowing a NULL-pointer dereference when accessing sysfs attributes.

A vulnerability in the Linux kernel's RedBoot partition table parser causes a boot crash. The issue arises from using memcmp() to read beyond the allocated buffer, triggering a buffer overflow warning and oops when FORTIFY_SOURCE is enabled.

In the Linux kernel, a vulnerability in the serial core driver causes an infinite loop in handle_tx() for PORT_UNKNOWN ports. The uart_write_room() function returns a value greater than zero while uart_write() returns 0 when the transmit buffer (xmit_buf) is uninitialized, leading to a system hang.

W jądrze systemu Linux zidentyfikowano podatność, która dotyczy synchronizacji przerwań przed wstrzymaniem GPU. W przypadku, gdy obsługa przerwań jest w toku na innym rdzeniu CPU, może dojść do awarii jądra podczas próby dostępu do rejestrów GPU.