CVE Vulnerability Catalog

A vulnerability in Apache Tomcat involving uncontrolled resource allocation allows an unauthenticated AJP request to pin an AJP processing thread, leading to denial of service. Affects versions 11.0.0-M1-11.0.25, 10.1.0-M1-10.1.59, and 9.0.0.M1-9.0.121.

A vulnerability in Apache Tomcat involving uncontrolled resource consumption during sending of WebSocket close message enables a DoS attack. Affects versions 11.0.0-M5-11.0.25, 10.1.8-10.1.59, and 9.0.74-9.0.121.

A vulnerability in Apache Tomcat involving a race condition allows an attacker to inject trailer fields into another HTTP/2 request. Affects versions 11.0.0-M1-11.0.25, 10.1.0-M1-10.1.59, and 9.0.39-9.0.121.

A vulnerability in Apache Tomcat related to improper authentication. When Jakarta Authentication is configured with SimpleAuthConfigProvider as the default provider and multiple web applications use that provider, the realm for the first web application to authenticate a request will be used for all web applications. Affects versions 11.0.0-M1-11.0.25, 10.1.0-M1-10.1.59, and 9.0.0.M4-9.0.121.

A vulnerability in ZohoCorp ManageEngine OpManager and Network Configuration Manager (versions before 12.8.671) allows an unauthorized Path Traversal attack.

A vulnerability in ZohoCorp ManageEngine OpManager and Firewall Analyzer (versions 12.8.669 and below) allows an SQL Injection attack in Rule Management Search Reports.

ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below are vulnerable to a Server-Side Template Injection vulnerability in Configlet processing, which could lead to Remote Code Execution.

The Reachy Mini daemon exposes an HTTP endpoint POST /apps/install with no authentication whatsoever. The endpoint accepts the name of a public Hugging Face Space, downloads it and installs it as a Python package, which executes attacker-chosen code. On the wireless version the daemon binds to 0.0.0.0, so any host on the same LAN can install and run arbitrary code on the robot.

A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary code from the edited file while performing syntax checking. Viewing or editing untrusted files using Emacs could lead to arbitrary code execution with the privileges of the user running Emacs.

Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely (demonstrated by uploading the EICAR test file), which could result in the system being completely compromised.

Pake, a tool that turns websites into Tauri-based desktop applications, generates apps with two unsafe default settings. The IPC capability configuration accepts connections from any HTTPS origin (wildcard "https://*.*"), and withGlobalTauri exposes the native Tauri API to ordinary page JavaScript. Because Tauri's access control list only checks plugin commands (plugin:), not app commands registered by the application, any HTTPS origin can invoke the app's native commands, including download_file.

When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no indication that recursive access was granted, and the expanded scope cannot be revoked for the lifetime of the application.

Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce.

A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-origin evidence. This issue affects versions before 1.3.2. Users are recommended to upgrade to version 1.3.2, which fixes the issue.

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via the 'log' (Username) parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. WordPress core applies wp_unslash() to the 'log' POST value before dispatching the wp_login_failed action, stripping magic-quotes backslash escaping and allowing a raw single quote to reach the plugin's handler unimpeded.

NULL pointer dereference vulnerability in ASR Crane, Falcon on Linux (as_rrc module) allows Pointer Manipulation. This vulnerability is associated with program file 3g.mod/lib/src/urrsir.c.

An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata service endpoints. The affected endpoints relied on client-supplied node information for authentication without providing sufficient authentication of the requesting party. Under certain network configurations, a remote attacker may be able to bypass the intended access control and access internal FE metadata interfaces, potentially exposing sensitive cluster information. This issue affects Apache Doris: from 2.0.0 through 2.0.*, from 2.1.0 through 2.1.*, from 3.0.0 through 3.0.*, from 3.1.0 through 3.1.*, from 4.0.0 before 4.0.8, and from 4.1.0 before 4.1.4. Versions 1.2.x and earlier are not affected by this header-trust vulnerability.

CGServiSign developed by Changing has an OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer.

A use-after-free vulnerability exists in Foxit PDF Editor/Reader's JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resulting in an application crash.

A use-after-free vulnerability exists in Foxit PDF Editor/Reader's handling of PDF annotations. Reentrant annotation deletion triggered by embedded JavaScript can cause the application to access an annotation object after it has been released, resulting in a use-after-free condition and application crash.