CVE Vulnerability Catalog

The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade to version 2.3.3.

Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3.

Apache XmlSchema does not limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. The issue is fixed in version 2.3.3.

Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting by an incorrect buffer size calculation, causing out-of-bounds reading.

SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service.

Crash in the SPDY protocol dissector in versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service.

GitLab CE/EE has a vulnerability allowing arbitrary JavaScript execution in another user's browser session due to improper sanitization of path components in the merge request diff viewer. Affects versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1.

Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet, which can be used for configuration file upload, leading to information disclosure and integrity compromise. The servlet is intended for testing in non-production environments.

A security vulnerability in HPE OneView may be exploited remotely to perform session hijacking, data theft, or other unauthorized actions.

A potential security vulnerability in HPE OneView can be exploited to allow remote session hijacking or other unauthorized actions.

Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. The application searches for resource files in predictable paths under C:\gs\ that do not exist by default, and Windows default ACLs allow any authenticated user to create directories at the root of C:\. An attacker can create the expected directory structure and plant a malicious PostScript file, which is executed with full privileges of the Ghostscript process. Fixed in version 10.08.0.

Path Traversal vulnerability in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via the path parameter.

Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter.

Apache Karaf has a vulnerability in JMX MBeanServer security, where createMBean, registerMBean, and unregisterMBean operations are not subject to RBAC. This allows a user with the 'viewer' role to achieve remote code execution in the Karaf JVM by using MLet as a remote classloader.

In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content. Insecure deserialization of this content allows arbitrary code execution in the Octopus Server process.

Missing authentication in the local .NET backend (Fiddler.WebUi) of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel.

A vulnerability was identified in tacomall 1.0.0 in the OrgStaffServiceImpl.add function of ApiMaApplication.java in the api-admin Backend component. Manipulation of the isAdmin/jobId arguments leads to improper authorization. Remote exploitation is possible and the exploit is publicly available.

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlink when the app is installed or upgraded. In system-wide installations, the write is performed as root.

shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\n, \r, U+2028, U+2029) in that later string therefore ends the comment, and the rest of the string is parsed as shell input. `parse()` emits a comment token for a `#` in the middle of a word, so callers that combine `parse()` output with another untrusted string are affected. Fixed in 1.11.0: `quote()` throws a `TypeError` when a string after a `{ comment }` token contains a line terminator.

A security flaw has been discovered in REBUILD up to 4.4.11 in unknown code of the /commons/file-editor-save file. Manipulation of the url/fileKey argument results in missing authorization. The attack can be launched remotely and the exploit has been released.