CVE Vulnerability Catalog

SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 in the /edit_rooma.php file. An attacker can manipulate the ID argument to execute remote SQL queries.

Heap buffer overflow in ProFTPD mod_sftp. An authenticated SFTP user can send a packet with length 0, causing an underflow and buffer overflow, leading to session crash or potentially further consequences.

A security flaw was discovered in zevorn rt-claw up to version 0.2.0, involving server-side request forgery (SSRF). The issue affects the receiver_thread function in the file claw/services/swarm/swarm.c within the http_request component. The attack can be performed remotely, and the exploit has been publicly released.

A vulnerability was found in zevorn rt-claw up to version 0.2.0 in the functions claw_net_get and claw_net_post in the file claw/tools/tool_net.c. Manipulation of the url argument leads to server-side request forgery (SSRF). The attack can be performed remotely and the exploit is publicly available.

A vulnerability was found in zevorn rt-claw up to version 0.2.0 in the Swarm RPC Receiver component. The handle_rpc_request function in claw/services/swarm/swarm.c causes incorrect authorization, allowing remote exploitation. The exploit has been publicly disclosed and may be used.

A server-side request forgery (SSRF) vulnerability was found in the rt-claw library up to version 0.2.0 in the claw_net_get and claw_net_post functions. The issue is in the file claw/services/tools/net.c, where the url argument can be manipulated by an attacker. The exploit has been made public, and the project has not responded to the report.

Vulnerability in urwid web backend (urwid/display/web.py) generating session IDs using cryptographically insecure Mersenne Twister PRNG. Attacker can reconstruct PRNG state after observing ~334 IDs and predict all sessions. Also, session ID is used as FIFO filename in /tmp, allowing local users to enumerate active sessions.

Heap-based buffer overflow in getData() function in OpenPLC_v3 (webserver/core/modbus_master.cpp). Function reads data between delimiters into a buffer without size check, allowing authenticated attacker to send crafted HTTP POST to /modbus with oversized device_name, causing heap corruption.

SurrealDB before version 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP addresses. Attackers can host a public server that redirects to internal resources.

SurrealDB before versions 2.0.5, 2.1.5, and 2.2.2 fails to properly escape table and field names in the CLI export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious SurrealQL names; when a higher-privileged user imports the backup, the injected code executes, enabling privilege escalation and root-level takeover.

SurrealDB before versions 2.2.6, 2.3.6, 2.1.8, and 3.0.0-alpha.7 fails to validate DNS-resolved hostnames against deny-net restrictions in http::* functions. An authenticated user can use a hostname that resolves to a blocked IP, bypassing access controls.

Vulnerability in SurrealDB before version 1.1.0. Improper parsing of ID, DB, and NS headers in HTTP REST API requests with special characters. Unauthenticated attacker can send crafted HTTP requests causing an uncaught exception that crashes the server.

SurrealDB before version 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs.

Vulnerability in SurrealDB before version 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) in the RPC API. An unauthenticated attacker can supply a binary object with a subquery in place of credentials, leading to execution of the subquery in the context of the database owner with editor role.

SurrealDB before version 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations without explicit permissions. Attackers with database access or unauthenticated users on public instances can perform unrestricted operations on unprotected tables.

Vulnerability in the uproot library allows remote code execution by opening a crafted ROOT file. An attacker can inject malicious Python code into streamer metadata, which is then executed during class source code generation and compilation.

Uncontrolled resource consumption vulnerability in Apache Traffic Server. Affects versions from 9.0.0 through 9.1.13 and from 10.0.0 through 10.1.2.

Vulnerability in @fastify/reply-from versions 8.3.1 up to but not including 12.6.4. The internal URL cache key is built by concatenating the destination and source path without a delimiter, leading to key collisions and requests being routed to the wrong upstream, enabling cross-upstream data access and modification.

In @fastify/http-proxy versions 9.4.0 through 11.5.0, the resolved WebSocket destination path is not validated against the configured rewrite prefix. Attackers can use path traversal sequences to bypass the prefix and reach unintended upstream endpoints.

A stack-based buffer overflow vulnerability was found in Shibby Tomato 1.28 in the sub_42537C function of the Scheduler Name Handler component. Manipulation of the a1 argument allows remote exploitation. This project is superseded by FreshTomato.