CVE Vulnerability Catalog

Roo Code through 3.54.0 has a command injection vulnerability in the auto-approve execute feature. Attackers can bypass allowlist/denylist by nesting command substitutions inside parameter expansion defaults, allowing arbitrary command execution.

LimeSurvey up to versions 6.17.10 and 7.0.4 contains an SSRF vulnerability in the REST API survey template endpoint. Authenticated users can manipulate the Host header, causing the server to issue arbitrary HTTP requests, enabling access to internal network services and cloud metadata endpoints.

Broken access control vulnerability in Joomla extension Quix Page Builder before version 6.2.1. Authenticated users can upload media files regardless of their media management permissions.

Authenticated Stored XSS vulnerability in Quix Page Builder for Joomla (versions < 6.2.1). An authenticated builder user can inject scripts that execute for any visitor, due to unescaped output and unsanitized SVG.

Path traversal and file read vulnerability in Quix Page Builder for Joomla (versions < 6.2.1). Unauthenticated users can exploit form elements to read arbitrary files on the server.

The Joomla extension Quix Page Builder Pro below version 6.2.1 allows an authenticated user with core.create/core.edit permissions to inject PHP code into element content. This code is executed via the include() function when the view is cached (caching is enabled by default).

DNG SDK versions 1.7.1 2536 and earlier are affected by a stack-based buffer overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction – opening a malicious file.

All versions of IdentityIQ are vulnerable to unauthorized access to protected APIs and data due to improper validation of OAuth bearer tokens. An unauthenticated attacker can exploit this.

Vulnerability in ExtremeXOS (EXOS) – mv, cp, rm commands unsafely handle symbolic links, allowing an attacker with low privileges to access files outside the allowed scope. This can lead to root privilege escalation and persistent software modification.

ExtremeXOS (EXOS) uses an insufficiently random source to generate challenge values for debug-mode authentication. This allows predicting the response and activating debug-mode without authorization, potentially leading to root-level access and persistent software modification.

The libcupsfilters and cups-filters libraries lack an error recovery handler when reading PNG files. An attacker can send a crafted PNG print job, causing the print job processing to abort.

xrdp versions up to 0.10.6 launch Xvnc over UNIX sockets with insufficient authentication. A local authenticated attacker can bypass session isolation and unauthorizedly view or control other users' sessions. Only the Xvnc backend over UNIX sockets is affected.

Vulnerability in FreeScout (versions prior to 1.8.221) in the attachment download mechanism. An unauthenticated attacker can download any attachment created by an older version because token authentication is skipped for attachments with legacy token type.

Vulnerability in Chamilo version 1.11.40 and earlier. An authenticated user enrolled in a course (student, teacher, DRH) can remotely execute code in the main/inc/ajax/lang.ajax.php path, which is protected only by api_protect_course_script(true).

In the Linux kernel's Bluetooth L2CAP subsystem, a deadlock occurs during connection teardown. l2cap_conn_del() locks conn->lock and then waits for pending_rx_work, which also tries to lock the same mutex, causing a circular lock dependency.

A stack out-of-bounds vulnerability was found in the i2c-stub driver in the Linux kernel. A local user with access to /dev/i2c-* can send an I2C_SMBUS request with an invalid block length (data->block[0] > 32), causing a buffer overflow and potential privilege escalation.

A race condition was found in the Linux kernel's netfilter ipset module between dump operations and ip_set_list resize. The dump functions read the array pointer without proper RCU locking, leading to a use-after-free when a new set is created concurrently.

In the Linux kernel's Qualcomm rmnet driver, a use-after-free vulnerability occurs when deleting a network interface. The rmnet_dellink() function frees endpoint memory before the RCU grace period ends, allowing concurrent readers to access freed memory, leading to a page fault and potential code execution.

In Network-AI (TypeScript/Node.js multi-agent orchestrator) before version 5.12.2, a vulnerability was found where the 'path' field in backup manifest files is trusted. An attacker can place a malicious manifest, causing arbitrary file or directory deletion during backup pruning.

Vulnerability in xrdp due to improper validation of the totalLength field in the RDP protocol header. An unauthenticated attacker can send a crafted packet, causing an infinite CPU loop and resource exhaustion.