CVE Vulnerability Catalog

In libxml2 before version 2.15.4, there is an out-of-bounds read vulnerability in the xmlFAParsePosCharGroup function, related to the NXT macro in xmlregexp.

In the ramon-victor freegpt-webui project up to commit 098db3dfeb41555c2ca9269df0f13e10ec1c35dc, there is a race condition vulnerability in the getJailbreak function of the file server/config.py in the Jailbreak Mode component. The attack can be launched remotely but requires a high level of complexity and is assessed as difficult to exploit. The exploit has been released. The product uses a rolling release model, so version details are not available. This vulnerability only affects products that are no longer supported by the maintainer.

In the undici library before version 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2, the retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This can cause the response body to be longer than the Content-Length observed by the application. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, enabling response splitting or desynchronization.

undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to the full cache-read path. The response-storage gate also lacked a method check, so a response to an unsafe request that is heuristically cacheable or carries an explicit Cache-Control directive is stored and later replayed from cache. Because response headers from a remote origin are untrusted, an origin can answer once with a cacheable status and then have the client's own subsequent state-changing requests to that path served from the stale cache entry without ever reaching the origin, an integrity failure that occurs under the interceptor's default configuration. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

The dump interceptor in undici mishandles chunked responses without Content-Length when the body size exceeds the maximum limit. Instead of pausing or aborting, it signals early completion, causing a second completion signal that triggers an internal assertion and tears down the connection. The application observes a misleading success status with an empty or truncated body while the connection is actually disconnected.

IBM i versions 7.6 and 7.5 could allow a local authenticated attacker to obtain information from a privileged file when using SSH.

phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed() method grants access to all callers when main.enableAskQuestions is enabled, ignoring the records.allowQuestionsForGuests setting. Unauthenticated attackers can submit questions via the question/create API endpoint to bypass guest submission restrictions and inject spam into the admin moderation queue.

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before version 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image metadata on posts belonging to other users.

A vulnerability in Eleveo Quality Management 9.7.0 affects unknown code of the Conversation Review component. Manipulation leads to cross site scripting (XSS). Remote exploitation is possible, and the exploit has been publicly disclosed.

A vulnerability in Eleveo Call Recording Software 9.7.0 affects an unknown part of the file /callrec/roleAddAction.do. Manipulation of the argument name/username leads to cross site scripting (XSS). The attack may be launched remotely, and the exploit has been published.

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a read and/or write data outside the Guest's virtualised GPU memory. The firmware uses data provided by the Guest VM to set up accesses to memory, but a TOCTOU bug was present which allowed the earlier check results to be invalidated.

Xpdf 4.06 and earlier versions contain a divide-by-zero vulnerability when a glyph in a Type 3 font has a zero height. This can lead to program crashes or unexpected behavior.

A cross-site scripting (XSS) vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0 in the file /index.php?q=orderdetails. Manipulation of the location argument leads to reflected XSS. The attack can be launched remotely and the exploit is publicly available.

Google Chrome prior to version 152.0.7977.82 has an out-of-bounds read vulnerability in CrashReporting. A remote attacker who compromised the renderer process could read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

In the Waku framework (minimal React framework) prior to version 1.0.0-beta.1, the unstable_redirect() helper from waku/router/server accepts an arbitrary string and reflects it unchanged into the HTTP Location header with no URL validation, scheme restriction, or path-only enforcement. Applications passing user-controlled input to this helper are vulnerable to open redirect attacks.

A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no privileges on the application that links the driver, may cause a small amount of data outside the intended buffer to be altered.

A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df. The affected element is an unknown function of the file service/server/routes_agent.py of the component selfRegister API Endpoint. Such manipulation of the argument initial_balance leads to business logic errors. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. profit_percent_for_display() divides by INITIAL_CAPITAL + deposited, and challenge scoring's return_pct also normalises against the attacker-inflated starting_cash. So an inflated initial_balance does not yield artificial percent returns - it inflates the absolute cash/equity column only, which is a cosmetic/leaderboard-gaming concern in a simulated game.

A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/(shareLayout)/webapp-signin/components/mail-and-password-auth.tsx of the component WebApp Sign-In. Such manipulation of the argument redirect_url leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page. This allows attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to.

A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages. An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in the victim's BIG-IP Configuration utility web browser session. This is a control plane issue; there is no data plane exposure.