CVE Vulnerability Catalog

In ssh-agent in OpenSSH before 9.6, destination constraints can be incompletely applied when adding PKCS#11-hosted private keys. Constraints are only applied to the first key, even if the PKCS#11 token returns multiple keys.

The 'Create a Space' feature in Silverpeas Core 6.3.1 is reserved for administrators but suffers from broken access control, allowing any authenticated user to create a space by navigating to the correct URL.

A vulnerability in Silverpeas Core 6.3.1 administrative 'Bin' feature allows a low-privileged user to access the bin, revealing all deleted spaces. The user can then restore or permanently delete these spaces.

Silverpeas Core 6.3.1 is vulnerable to Cross Site Scripting (XSS) via the message/notification feature. An attacker can inject malicious JavaScript code into message content.

Silverpeas Core 6.3.1 has an incorrect access control vulnerability in the 'Porlet Deployer' component, allowing administrators to deploy .WAR portlets. This could lead to unauthorized code execution or privilege escalation.

DedeCMS v5.7.111 was found to have a reflective cross-site scripting (XSS) vulnerability in the select_media_post_wangEditor.php component. An attacker can inject malicious JavaScript code into a request, which will be executed in the victim's browser.

A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information.

A stored cross-site scripting (XSS) vulnerability was discovered in DaiCuo version 2.5.15 in the /admin.php file. Attackers can inject malicious JavaScript or HTML via crafted input.

In MISP before version 2.4.179, there is an XSS vulnerability in the event timeline widget located in app/Lib/Tools/EventTimelineTool.php.

The vulnerability in aiohttp allows an attacker to modify the HTTP request through improper validation, potentially leading to header injection or the creation of new requests if the attacker controls the HTTP method.

The Email Encoder plugin for WordPress by Jannis Thuemmig in version 2.1.8 and earlier contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.

A Cross-Site Scripting vulnerability in Wonder CMS versions 3.2.0 through 3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component.

Vim has a use-after-free vulnerability in memory allocated in the `ga_grow_inner` function. This issue can occur when using the `:history` command, leading to an integer overflow and potential use-after-free.

A use-after-free flaw was found in the xorg-x11-server that may lead to an X server crash in a specific multi-screen configuration. The issue occurs when the pointer is warped from a window on one screen to the root window of another screen, followed by the destruction of the original window and then another window.

An out-of-bounds read flaw was found in the GRUB2 NTFS filesystem driver. A physically present attacker can present a specially crafted NTFS image to read arbitrary memory locations. A successful attack allows sensitive data cached in memory or EFI variable values to be leaked, posing a high confidentiality risk.

A vulnerability in the ArchiveBox web archiving system allows malicious JavaScript execution in the context of an admin session. The issue affects users who use the `wget` extractor and view archived pages. Malicious code can hijack admin privileges and perform arbitrary operations on the archive.

Multiple Stored Cross Site Scripting (XSS) vulnerabilities in Opart opartmultihtmlblock before version 2.0.12 and Opart multihtmlblock* version 1.0.0, allow remote authenticated users to inject arbitrary web script or HTML via the body_text or body_text_rude field in /sourcefiles/BlockhtmlClass.php and /sourcefiles/blockhtml.php.

A memory leak flaw was found in Libtiff's tiffcrop utility that occurs when processing a TIFF image file. An attacker can pass a crafted TIFF image file to the tiffcrop utility, causing this memory leak issue, resulting in application crashes and ultimately leading to denial of service.

A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload in the subcmd parameter of the index.php component.

A Cross Site Scripting (XSS) vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary JavaScript code via a crafted title parameter in the index.php component.