CVE Vulnerability Catalog

A stack-based buffer overflow in desktop.c in Netatalk versions 1.3 through 4.2.2 allows a remote authenticated attacker to cause a denial of service, obtain limited information, or modify limited data.

Netatalk 2.0.0 through 4.4.2 generates AFP session tokens derived from predictable process IDs, which allows a remote authenticated attacker to cause a denial of service by exploiting the reconnect mechanism.

In mlflow/mlflow up to version 3.9.0, the SearchModelVersions REST API and GraphQL endpoints lack proper authorization checks, allowing any authenticated user to enumerate all model versions. Fixed in version 3.10.0.

The Avada (Fusion) Builder plugin for WordPress up to version 3.15.2 is vulnerable to stored XSS via multiple shortcodes due to insufficient input sanitization and output escaping.

The WPB Floating Menu & Categories for WordPress plugin up to version 1.0.8 has a Stored Cross-Site Scripting vulnerability in the 'Icon CSS Class' category field. Authenticated attackers with Editor-level access or above can inject arbitrary scripts that execute when users view the page.

The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.52.2 via the get_sponsored_meta AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disclose any private post metadata.

A heap buffer overflow vulnerability has been found in the libsolv library when processing a specially crafted .solv file with negative size values in the repo_add_solv function. This leads to undersized memory allocation and out-of-bounds write, which can be exploited for a DoS attack.

In libsolv, a stack-based buffer overflow vulnerability exists in the Debian metadata parser when processing specially crafted Debian repository metadata. An attacker can provide malicious SHA384 or SHA512 checksum tags, leading to memory corruption and denial of service (DoS).

In Plane (project management tool) versions 1.3.0 and below, the SavedAnalyticEndpoint passes user-controlled segment parameter directly to a Django F() expression without validation, causing ORM Field Reference Injection. An authenticated workspace member can read sensitive data such as bcrypt password hashes, API tokens, and email addresses.

In the nimiq-blockchain library (versions 1.3.0 and prior), network discovery accepts signed PeerContact updates from untrusted peers and stores them in the contact book, potentially causing an address book crash. An attacker can send a contact with an empty address list, causing a panic when accessing the address book.

Mantis Bug Tracker (MantisBT) up to version 2.28.1 is vulnerable to HTML and JavaScript injection in a textarea custom field on the Update Issue page. An authenticated attacker with low privileges can inject code that executes in the administrator's browser, leading to session theft and account takeover.

In MISP up to version 2.5.38, the ShadowAttribute proposal creation workflow accepted the 'id' field from the client, allowing authenticated users to update existing attributes instead of creating new proposals. This can lead to unauthorized data modification.

Google Chrome prior to version 148.0.7778.179 has insufficient validation of untrusted input in the Input component. A remote attacker who compromised the renderer process can leak cross-origin data via a crafted HTML page.

In Google Chrome on Mac prior to 148.0.7778.179, an out-of-bounds read in GPU allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium).

Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability has a Chromium security severity of High.

Insufficient policy enforcement in Service Worker in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

Google Chrome on Windows prior to version 148.0.7778.179 has an inappropriate UI implementation allowing a remote attacker to perform UI spoofing via a crafted HTML page.

TeleJSON prior to 6.0.0 contains a DOM-based XSS vulnerability in the parse() function. Attackers can deliver a crafted JSON with a malicious _constructor-name_ value, passed unsanitized to new Function(), enabling arbitrary JavaScript execution, e.g., via postMessage in cross-frame contexts.

Trilium Notes version 0.102.1 and prior contain a critical vulnerability allowing unauthenticated remote code execution (RCE). Lack of SVG sanitization combined with a disabled Content Security Policy (CSP) and a publicly reachable backend execution API allows an attacker to execute arbitrary Node.js code on the server by tricking an authenticated user into viewing a malicious SVG attachment.