CVE Vulnerability Catalog

The HDF5 library is vulnerable to an out-of-bounds read when a file is maliciously crafted – the array datatype size, element count, and element size are inconsistent. The vulnerability only occurs in deliberately altered files, not in normal usage.

Vulnerability in the Parsec file-sharing application: lack of workspace name sanitization allows using a UNC path. If the name is a UNC path, the application may become unresponsive or leak the NTLM hash.

A privilege escalation vulnerability in HCL Commerce could allow denial of service, disclosure of user personal data, and unauthorized administrative operations.

ProFTPD before versions 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect pr_fsio_stat() to system() via a crafted RENAME request.

An authenticated Server-Side Request Forgery (SSRF) vulnerability with low privileges was found in Apache Syncope via Connectors and Resources check. It allows an attacker to send requests from the server to internal systems.

FileBrowser Quantum before version 1.4.3-beta contains two path traversal vulnerabilities in the /api/media/subtitles endpoint. The 'path' and 'name' parameters are not properly sanitized, allowing any authenticated user to read any text file on the server, including /etc/passwd, SSH keys, and credentials.

Directory Traversal vulnerability in Menyoo 2.0 before commit 729aa48. A local attacker can execute arbitrary code via Spooner file management, VehicleSpawner, WeaponOptions, and PedComponentChanger functionalities.

Vulnerability in FileBrowser Quantum prior to versions 1.3.2-stable and 1.4.1-beta may leak sensitive information such as source and path. Fixed in versions 1.3.2-stable and 1.4.1-beta.

In CI4MS (versions before 0.31.9.0), the Pages module does not sanitize page content before saving to the database, and the view renders it without escaping, leading to stored XSS. The attack affects every visitor, including administrators.

A SQL injection vulnerability has been discovered in Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System 8.2.2. The flaw exists in the file /admin/system/structure/updateStructure/deflate/Insecure/Staffshinel Ds.jsp?Shine ID=aaa, where the Structure_ID parameter is vulnerable to SQL injection. The attack can be performed remotely and the exploit has been made public.

A vulnerability was found in Tenda AC10 version 16.03.10.09_multi_TDE01 in the fromAdvSetLanip function of the /goform/AdvSetLanip file. Manipulation of the GetValue/SetValue arguments leads to a stack-based buffer overflow, which can be exploited remotely.

Vulnerability in QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. The attack can lead to ownership of arbitrary root-owned files or directories, resulting in root access.

Network-AI before version 5.13.4 has an improper cryptographic signature verification vulnerability in APSAdapter. The default local verifier accepts any non-empty string as valid. An unauthenticated attacker can submit forged APS delegation payloads with arbitrary scopes to bypass signature verification and obtain permission tokens for sensitive resources including SHELL_EXEC.

Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply configured authorization to GET /approvals/ routes, allowing unauthenticated actors to access sensitive approval data including shell commands, file paths, and risk levels. Additionally, the Access-Control-Allow-Origin: * header enables cross-origin disclosure.

Double-free vulnerability in FreeRDP before version 3.28.0 (3.x through 3.27.1) in freerdp_client_rdp_file_apply_to_settings() when parsing the selectedmonitors field of a .rdp file. An attacker can convince a victim to open a crafted .rdp file with oversized monitor tokens, causing a double-free and potentially code execution.

Privilege escalation vulnerability in SurrealDB before 2.5.0 and 3.0.0-beta.3. Unprivileged users can create or modify fields containing futures, functions, or closures that execute in the context of a privileged user, leading to privilege escalation up to server takeover.

SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the process.

Vulnerability in SurrealDB before version 3.1.0. The HTTP /rpc sessions method returns session UUIDs without authentication and accepts arbitrary session fields without ownership verification. Unauthenticated attackers can enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges.

Time-of-check/time-of-use race condition in SurrealDB before version 3.1.0 in the HTTP /rpc endpoint. Unauthenticated requests can inherit authenticated session state, allowing privilege hijacking.

Denial of service vulnerability in SurrealDB before version 3.1.0, in the RPC use handler that panics when db is set without a namespace. Unauthenticated attackers can send a malformed WebSocket message to the /rpc endpoint to crash the server process.