CVE Vulnerability Catalog

Incorrect Calculation vulnerability in RTI Connext Professional (Core Libraries) allows Abuse Existing Functionality. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, from 4.1x before 5.1.*.

Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.2.3 before 5.2.*.

An HTTP endpoint intended for provisioning enterprise and reseller organizations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The only check is that the request body carries a token with a valid signature, but it does not check what the token was issued for, allowing an ordinary user's own session token to pass. This allows creating a new organization with the highest subscription tier and immediate API key.

LightRAG prior to 1.5.5 contains a vulnerability in the Markdown parser that allows fetching resources with internal IPv4 addresses using NAT64 translators, potentially leading to unauthorized access to internal resources.

Sentry from 23.11.0 to 26.7.0 with relocation feature enabled unsafely deserializes a legacy database field while importing a user-supplied relocation archive. An authenticated user can craft an archive that causes arbitrary code execution in the import worker process.

Netdata prior to 2.10.4 contains a vulnerability in the setuid-root ndsudo helper command fail2ban-client-status-socket which accepts a caller-controlled --socket_path from the low-privileged netdata service account, allowing attacker-controlled code to execute as root on systems with fail2ban-client installed.

Netdata prior to 2.11.0 contains a vulnerability in the unauthenticated WebSocket server that allows an attacker to send small highly compressed frames, leading to large server-side allocations and causing memory exhaustion and termination of monitoring.

Netdata from 2.0.0 to 2.10.4 contains a vulnerability during MSI repair where powershell.exe runs as SYSTEM without -NoProfile and loads the user's PowerShell profile, allowing commands placed in that profile to execute with SYSTEM privileges.

MISP registers PHP's phar stream wrapper in both its web and console entry points. This causes filesystem operations on caller-influenced paths to trigger implicit unserialize() (a deserialization sink), and a relocated application root can reach executable code inside an uploaded phar file, enabling code execution as the web user.

Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes in the system.

Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during acceptance. Attackers with a leaked or forwarded invitation link can load the page while pending, then accept the invitation after the legitimate user has already accepted it to overwrite the account password and gain authenticated access to managed database credentials and secrets.

Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digital goods purchased by other customers.

A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage.

Twenty is an open-source CRM platform. Prior to 2.22.0, field-level read permission is enforced on selected output fields but not on GraphQL or REST filter predicates. A workspace member or API key with permission to read an object but not a particular field can reference that denied field in direct filters, relation filters, or persisted view filters. The resulting totalCount and row presence reveal whether guesses match the real column, forming a boolean/count oracle that can reconstruct denied field values for records exposed by the principal's row-level policy.

Lantronix SLC8000 (before firmware v9.7.0.3), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882 contain an SSRF vulnerability in the WebSSH/WebTelnet listener. An unauthenticated attacker can modify the rooturl parameter to redirect the Telnet connection to an arbitrary host or IP. This enables enumeration of and communication with internal network endpoints.

Lantronix SLC8000 (before firmware v9.7.0.3), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882 contain an SSRF vulnerability in the WebSSH/WebTelnet listener. An unauthenticated attacker can modify the rooturl parameter to redirect the SSH connection to an arbitrary host or IP. This enables enumeration of and communication with internal network endpoints.

Lantronix SLC8000 (before firmware v9.7.0.3), SLC9000 (before v9.7.0.2), EMG8500/EMG7500 (before v9.7.0.1), and all firmware versions of SLB882 contain an SSRF vulnerability in the WebSSH/WebTelnet listener. The custom shellinaboxd builds its SSH connection target using snprintf with user-supplied input; supplying an overlong username truncates the device IP suffix and redirects the connection to an arbitrary host. This enables enumeration of and communication with internal network endpoints.

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload checks a stale in-memory user storage value and later applies an unconditional storage charge outside the same quota-enforcing transaction. An authenticated user with Files.Write permission can issue concurrent upload-session requests that read the same capacity snapshot, all pass the MaxStorage check, and reserve their declared sizes through CommitWithStorageDiff, exceeding the account quota and exhausting host storage.

In Vector from 0.15.0 until 0.57.0, the logstash source feeds each decompressed frame back into its decoder without limiting nested compression depth. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send many nested compressed frames, causing recursive decoding that exhausts the worker thread stack and aborts the process. This issue is fixed in version 0.57.0.