CVE Vulnerability Catalog

EspoCRM versions 9.3.3 and below allow authenticated users to upload SVG attachments through normal attachment-capable fields and later serve those SVG files as top-level inline documents, resulting in stored cross-user XSS. Although inline SVG script is blocked by CSP, same-origin external script is allowed, so an attacker can upload a malicious SVG together with a second attacker-controlled JavaScript attachment and trick another user into opening the SVG to execute JavaScript.

In libheif (versions 1.21.2 and below), a crafted HEIF file with samples_per_chunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor, leading to an out-of-bounds read and crash (SEGV) on the first frame access. The file parses without error, but crashes when attempting to display.

NULL pointer dereference vulnerability in NanoMQ MQTT Broker versions 0.24.10 and below during high-concurrency reconnect traffic. Causes broker crash (DoS) without authentication. Fixed in version 0.24.11.

A command injection vulnerability in Panabit PAP-XM320 up to V7.7. The management interface calls /usr/sbin/pappiw with user-controlled parameters processed by eval, allowing arbitrary shell command execution.

Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another app on the same device to request arbitrary URLs and receive responses with the signed-in user's cookies. Fixed in Firefox for iOS 151.0.

Technitium DNS Server before version 15.0 aggressively tries to fetch missing RRSIG records or mismatched DNSKEY records. An attacker controlling a domain can cause excessive network traffic.

An issue was discovered in the Portrait Dell Color Management application before 3.7.0 for Dell monitors. On Windows, a symbolic link vulnerability allows a local low-privileged user to escalate privileges to Administrator. During installation, the software writes the file CCFLFamily_07Feb11.edr to C:\ProgramData\Portrait Displays\CW\data\i1D3\ while running with elevated privileges. Because the installer does not properly validate symbolic links or reparse points at the destination path, an attacker can create a malicious link that redirects the write operation to an arbitrary system location, enabling arbitrary file creation or overwrite with elevated privileges.

A same-origin policy bypass exists in the Networking: JAR component of Firefox and Thunderbird. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

A Spoofing vulnerability in the Form Autofill component of Firefox and Thunderbird. The issue was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

A Stored HTML Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. An authenticated user with limited privileges can push malicious remote strategies containing HTML tags, which render in the victim's browser.

A Stored HTML Injection vulnerability was discovered in the Schedule Restore Archive functionality due to improper validation of an input parameter. An authenticated user with administrative privileges can define a malicious restore schedule containing HTML tags.

A Stored HTML Injection vulnerability was discovered in the Users functionality due to improper validation of an input parameter. An authenticated user with administrative privileges can create a malicious user whose username contains HTML tags, leading to potential phishing attacks.

A Stored HTML Injection vulnerability was discovered in the Credentials Manager functionality due to improper validation of an input parameter. An authenticated user with administrative privileges can define a malicious identity containing HTML tags, leading to potential phishing attacks.

An Angular template injection vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user with report privileges can define a malicious report containing an Angular template payload.

W Keycloak znaleziono lukę, która pozwala uwierzytelnionemu klientowi wykorzystać podatność Insecure Direct Object Reference (IDOR) w punkcie końcowym API Ochrony Usług Autoryzacji. Znając unikalny identyfikator zasobu (UUID) należący do innego Serwera Zasobów w tym samym obszarze, klient może obejść kontrole autoryzacji.

In the Linux kernel, an integer underflow vulnerability was found in the mpi_read_raw_from_sgl() function in the MPI library. The bug occurs when the scatterlist occupies more bytes than the 'nbytes' parameter and the first 'nbytes + 1' bytes are zero, leading to an infinite loop and DoS.

In the Linux kernel, a vulnerability in net: qrtr: ns allowed unlimited server registration per node. A malicious client can flood NEW_SERVER messages, exhausting memory. Fixed by limiting server registrations to 256 per node and rate-limiting error messages.

W Keycloak odkryto lukę w uwierzytelnianiu, która pozwala zdalnemu atakującemu na ponowne wykorzystanie tokenów `ExecuteActionsActionToken` w procesie WebAuthn. Atakujący, przechwytując link e-mailowy do wykonania akcji, może zarejestrować własny uwierzytelniający w koncie ofiary.

W Keycloak odkryto lukę w kontroli dostępu, która pozwala zdalnemu uwierzytelnionemu użytkownikowi, posiadającemu przynajmniej jeden zasób zarządzany przez użytkownika (UMA), na enumerację i zbieranie danych osobowych wszystkich użytkowników w danym realmie. Wysyłając odpowiednio skonstruowane żądania z dowolnymi nazwami użytkowników lub adresami e-mail, można uzyskać pełne obiekty profilu dla niepowiązanych użytkowników.

W Keycloak odkryto lukę w kontroli dostępu, która pozwala poufnemu klientowi na ominięcie ograniczeń dotyczących odbiorców w punkcie introspekcji tokenów OpenID Connect (OIDC). Klient kontrolowany przez atakującego, posiadający ważne poświadczenia, może uzyskać dostęp do wrażliwych informacji zawartych w tokenach przeznaczonych dla innych serwerów zasobów.