CVE Vulnerability Catalog

The vulnerability in the /v1/upload/sbom endpoint allows an unauthenticated attacker to inject fake log entries by manipulating the iss claim in a JWT token. Due to disabled JWT signature verification and literal newline rendering in the log format, the attacker can create entries indistinguishable from genuine successful authentication messages.

Multiple stack-based buffer overflows were discovered in the xmlcatalog utility of libxml2 when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking. Supplying an overly long input line can overflow internal buffers (command, arg, and argv) during input parsing.

GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. By decompressing a specially crafted LZW file followed by an LZH file in one gzip -d command, an attacker can poison the shared global state and trigger an out-of-bounds read in the LZH decoder.

GNU gzip has a vulnerability in the gzexe utility related to insecure temporary file handling. When mktemp is not available in the user's PATH, gzexe creates a temporary file with a predictable name based solely on the PID, without exclusive access or existence checks. A local attacker can pre-create this path as a symlink to an arbitrary writable file, causing a TOCTOU condition that allows arbitrary file overwrite.

A stack-based buffer overflow vulnerability was found in the formPPPoESetup function of the /goform/formPPPoESetup file in Edimax EW-7478APC version 1.04. An attacker can remotely manipulate the pppUserName argument, causing a buffer overflow. The exploit has been made public and could be used.

A stack-based buffer overflow vulnerability was found in Edimax EW-7478APC version 1.04 in the formL2TPSetup function. An attacker can remotely manipulate the L2TPUserName argument, causing a buffer overflow. The exploit is public, and the vendor did not respond.

A buffer overflow vulnerability was found in Edimax EW-7478APC version 1.04 in the formiNICSiteSurvey function of the /goform/formiNICSiteSurvey file. Manipulation of the selSSID argument allows remote attack. The exploit has been published and may be used.

A vulnerability was found in Edimax EW-7478APC version 1.04, allowing OS command injection via the rootAPmac argument in the formiNICbasic function. The attack is remotely exploitable and the exploit is publicly available.

A security vulnerability has been detected in Edimax EW-7478APC 1.04, where the formAccept function in /goform/formAccept of the POST Request Handler component is vulnerable to OS command injection via the submit-url argument. The attack can be performed remotely, and the exploit has been publicly disclosed.

A SQL injection vulnerability has been found in Real State Services 1.0 in the file /single-list_sale.php?action=add. Manipulating the ID argument allows remote exploitation. The exploit is publicly available, increasing the risk of attacks.

A security flaw has been discovered in CodeAstro Complaint Management System 1.0, affecting the Report Handler component. Manipulation of the Report Title argument in the /report/addreport file leads to cross-site scripting (XSS). Remote exploitation is possible, and the exploit has been publicly released.

The Embed Privacy plugin for WordPress contains a path traversal vulnerability that allows an attacker to access files outside the restricted directory. The issue affects versions from 1.0.0 through 1.12.3.

A relative path traversal vulnerability in libzypp before 17.38.10 allows remote attackers to overwrite system files by processing malicious repository metadata. This can lead to denial of service or privilege escalation.

A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) in yelp-xsl. A malicious Flatpak application can open crafted help content via the OpenURI portal, embedding an untrusted CSS stylesheet within a structured SVG document. This allows bypassing Flatpak's sandbox isolation, enabling Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests.

A cross-site scripting vulnerability was found in itsourcecode Online Hotel Management System 1.0 in the file /admin/mod_room/controller.php?action=add. Manipulation of the Name argument in a POST request allows remote injection of malicious scripts. The exploit is publicly available.

A cross-site scripting vulnerability was found in itsourcecode Online Hotel Management System 1.0. An unknown part of the file /admin/mod_users/controller.php?action=edit in the POST Request Handler component allows manipulation of the Name argument, leading to script execution. The attack can be performed remotely and the exploit has been publicly disclosed.

A SQL injection vulnerability was found in Online Hotel Management System 1.0 in the file /admin/mod_users/controller.php?action=add. Manipulation of the Name argument allows remote SQL injection. The exploit has been made public, increasing attack risk.

A cross-site scripting vulnerability was found in Online Hotel Management System 1.0 in the file /admin/mod_amenities/controller.php?action=add. Manipulation of the Name argument in a POST request allows remote script injection. The exploit has been disclosed.

A flaw in Online Hotel Management System 1.0 in the file /admin/mod_amenities/controller.php?action=add allows unrestricted file upload via the image argument. This can lead to remote code execution. The exploit has been published and may be used.

A SQL injection vulnerability was found in the Online Hotel Management System 1.0 in the file /admin/mod_amenities/controller.php?action=edit. An attacker can remotely manipulate the amen_id argument, leading to SQL injection. The exploit is publicly available.