CVE Vulnerability Catalog

Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to commit b4d23df contains a server-side request forgery (SSRF) vulnerability in the image proxy. Authenticated attackers can embed attacker-controlled URLs in BBCode image tags, which the proxy fetches without validating resolved destination IPs against private address ranges, loopback, or link-local addresses.

A CSRF vulnerability in linux-server v.1.0 through v.2.3.8 allows a remote attacker to execute arbitrary code via the uploadPutHandler function.

A vulnerability in Tornado before version 6.5.6 allows unlimited decompression of gzip data, potentially leading to memory exhaustion by a malicious server or SimpleAsyncHTTPClient.

In Tornado before version 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.

Soup Sieve library prior to version 2.8.4 contains a denial-of-service vulnerability due to a regular expression prone to catastrophic backtracking. An attacker can supply an untrusted CSS selector with an unterminated quoted attribute value, causing CPU exhaustion.

Soup Sieve before version 2.8.4 allocates unbounded memory when compiling large comma-separated selector lists. An attacker can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select()/.select_one(), causing hundreds of megabytes of heap memory allocation and denial of service.

In sigstore-js before version 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification. This means required certificate extension OIDs are never checked, and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates.

The linkify-it library before version 5.0.1 has a quadratic algorithmic complexity vulnerability in the LinkifyIt.prototype.match function. For inputs containing many fuzzy links or emails, the scanning loop repeatedly re-slices input and re-runs regex searches on progressively shorter tails, causing excessive CPU usage.

Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Creative Cloud Desktop is affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control and does not require user interaction. Scope is changed.

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Bridge is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, as a victim must open a malicious file.

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, as a victim must open a malicious file.

Bridge is affected by an Untrusted Pointer Dereference vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction to open a malicious file.

Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

An SSRF vulnerability in ColdFusion allows a low-privileged attacker to bypass security measures and gain unauthorized read access. Exploitation does not require user interaction and the scope is changed.

ColdFusion suffers from an Improper Input Validation vulnerability that allows a security feature bypass. A low-privileged attacker can exploit this to gain unauthorized read access without user interaction. The scope of the vulnerability is changed.