CVE Vulnerability Catalog

Open5GS versions up to 2.7.7 contain an out-of-bounds read vulnerability in the function ogs_sbi_client_send_via_scp_or_sepp in the library lib/sbi/client.c in the NF component. An attacker can remotely manipulate data, leading to out-of-bounds read.

In Open5GS up to version 2.7.7, there is a vulnerability in the _gtpv1_u_recv_cb function of src/upf/gtp-path.c in the UPF component. Manipulation leads to resource exhaustion. The attack can be performed remotely. The project has not responded to the report.

A vulnerability in UGREEN CM933 version 1.1.59.4319 involves missing authentication in the administrative interface. The attack requires local network access. The vendor confirmed the issue and plans a fix in late April.

Some EZVIZ products use older cloud feature modules with legacy API interfaces, posing a data transmission risk. Attackers can eavesdrop on network requests to obtain data.

An access control vulnerability in some HikCentral Professional versions could allow an unauthenticated user to obtain admin permission.

Pillow (Python imaging library) from version 4.2.0 to before version 12.2.0 contains a vulnerability where an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive.

Pillow (Python imaging library) from version 11.2.1 to before version 12.2.0 contains a heap buffer overflow vulnerability when passing nested lists as coordinates to APIs such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line. Nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates.

Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances each glyph by an excessively large amount, an integer overflow may occur when tracking the current position.

A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL access to the unauthorized page.

An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, configuration variables) via unprotected endpoints lacking adequate security headers.

Gibbon before version 30.0.01 has a path traversal vulnerability leading to DoS by attempting extraction of PHP files. Failed .zip extraction results in file deletion and DoS. Teacher or higher privileges required.

Argo Workflows from version 4.0.0 to before 4.0.5 logs all artifact repository credentials (S3 access keys, secret keys, GCS service account keys, Azure account keys, Git passwords, etc.) in plaintext during artifact operations. Any user with read access to workflow pod logs can extract these credentials. This is fixed in version 4.0.5.

Argo Workflows versions 4.0.0 to 4.0.5 have a nil pointer dereference in rbacAuthorization() in server/auth/gatekeeper.go, causing a panic (denial of service) for SSO users whose claims match a namespace-level RBAC rule but not an SSO-namespace rule when SSO_DELEGATE_RBAC_TO_NAMESPACE=true.

Kirby CMS before versions 4.9.0 and 5.4.0 does not check user permissions for avatar creation, replacement, and deletion. Any user can modify others' avatars without proper rights.

In Kirby (content management system) versions prior to 4.9.0 and 5.4.0, the `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API.

Kirby prior to versions 4.9.0 and 5.4.0 does not gate read access to site, user and role information by permissions, allowing unauthorized users to access this data.

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, the system API endpoint leaks license data and installed version to authenticated users. This issue has been patched in versions 4.9.0 and 5.4.0.

The LatePoint plugin for WordPress up to version 5.5.0 is vulnerable to account takeover due to a weak password recovery mechanism in the unauthenticated guest booking flow. The save_connected_wordpress_user() function propagates a LatePoint customer's email to the linked WordPress user account without ownership verification, and the guest booking flow can overwrite an existing customer's email via phone-based merge without authentication.

PgBouncer before 1.25.2 did not properly authorize the KILL_CLIENT admin command. Any user with access to the admin console could run it, instead of only users in the admin_users list.

In PgBouncer before version 1.25.2, a null pointer dereference could cause a crash if a server sends an error response without the SQLSTATE field.