CVE Vulnerability Catalog

InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop that allows unauthenticated attackers to terminate the inference engine. Attackers can submit a migration_request with an empty remote_block_ids list to trigger an AssertionError that crashes the engine loop and causes subsequent inference requests to fail.

HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters to write files to attacker-chosen paths with web server privileges, potentially enabling code execution.

vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory. Attackers can bypass the buffer allocation cap by using these V8 intrinsics to exhaust host process memory and trigger out-of-memory conditions.

vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not available', the sandbox's Promise static methods (Promise.resolve, Promise.all, Promise.race, Promise.any, and Promise.allSettled) still assimilate attacker-supplied thenables, allowing sandboxed script to schedule work that runs after VM.run() or NodeVM.run() has returned and outside the configured timeout.

vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries (e.g. require: { builtin: ['*', '-fs', '-child_process'] }), negative entries are matched by exact module name, so -fs removes only the builtin named fs and does not remove builtin subpaths such as fs/promises. Sandboxed code can therefore call require('fs/promises') or require('node:fs/promises') and reach the promise-based filesystem API despite fs being denied.

vm2 versions >= 3.10.0 and <= 3.11.7 do not mark Promises returned from the host realm into the sandbox as handled at the bridge boundary. Only Promises created inside the sandbox are wrapped with a rejection-swallowing handler, and the bridge only installs host-side rejection sanitizers when sandbox code calls .then/.catch/.finally. As a result, sandboxed code can invoke a host function that returns a rejected Promise and ignore the return value, leaving the host Promise unhandled so that Node.js's default unhandled-rejection behavior terminates the host process.

A vulnerability in the vm2 CLI tool (before 3.11.7) allows sandbox escape and arbitrary code execution in the host Node.js process. Attackers can supply a malicious script that uses require(__filename) to re-execute itself in the host realm, bypassing sandbox isolation and accessing host modules like fs and child_process.

In vm2 versions ≤ 3.11.6, the VM({ timeout }) option is not enforced for code executed outside the synchronous VM#run() call. Sandboxed code can register a FinalizationRegistry callback and, after dropping an object reference, block the host event loop indefinitely, causing denial of service.

An unauthenticated Cross-Site Scripting (XSS) vulnerability in Visitor Traffic Real Time Statistics Pro versions ≤ 11.21 allows attackers to inject malicious scripts without authentication.

An unauthenticated Cross-Site Scripting (XSS) vulnerability in WP Inventory Manager versions ≤ 2.5.4 allows attackers to execute scripts in the victim's browser without authentication.

google-protobuf contains unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire bytes to a Node.js service calling deserializeBinary(), causing a RangeError: Maximum call stack size exceeded and crashing the process.

An inefficient algorithmic complexity vulnerability in AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in an API key. The decoding functions have quadratic/cubic complexity and do not limit input length.

An authorization bypass vulnerability in AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, leading to account takeover. A confirmation token issued for one user is accepted on another user's record.

The "Use of HTTP Request With Sensitive Query String" vulnerability in AshAuthenticationPhoenix causes a single-use sign-in token to be passed as a query parameter in the URL during login redirect. The token can be exposed in server logs, browser history, etc.

Dell OpenManage Server Administrator versions prior to 11.1.0.3 contain an improper privilege management vulnerability. A low-privileged attacker with remote access could potentially exploit this to tamper with information and gain unauthorized access.

An improper authentication vulnerability in AshAuthentication allows an attacker with a sign-in token for one authenticated resource to be signed in as a user of a different resource. The issue arises from incorrect parsing of the sub claim in the JWT token.

The Xagio SEO plugin in versions up to and including 7.1.0.43 contains an Unauthenticated Cross Site Request Forgery (CSRF) vulnerability. The lack of CSRF protection allows an attacker to force a logged-in user to perform unwanted actions.

The MC Woocommerce Wishlist plugin in versions up to and including 1.9.21 contains an Administrator SQL Injection vulnerability. This allows an administrator-level user to inject malicious SQL code into database queries.

The PublishPress Series plugin in versions up to and including 3.1.3 contains an Administrator SQL Injection vulnerability. This enables an administrator-level user to inject malicious SQL code into database queries.

The WP-Lister Lite for eBay plugin in versions up to and including 3.8.11 contains a Shop manager SQL Injection vulnerability. This allows a shop manager-level user to inject malicious SQL code into database queries.