CVE Vulnerability Catalog

A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before version 1.4.0, in the interaction model command processing logic. Sending an InvokeCommandRequest to a nonexistent endpoint and cluster (e.g., 0x34) causes the code to incorrectly treat the endpoint as valid due to missing checks in CodegenDataModelProvider::Invoke, leading to a VerifyOrDie failure in ProcessCommandDataIB and a crash (SIGABRT). The issue has been acknowledged and fixed in a later revision (PR #37207).

A use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before version 1.4.0. The `GetDestinationGroupId().Value()` method is called without checking if a value exists, leading to a crash when an InvokeCommand is sent without initializing the destination group ID.

A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before version 1.4.0, affecting the ReadRevisionAttribute function used in multiple clusters (Channel, Account Login, TargetNavigator, etc.). The function lacks proper validation of the delegate pointer before dereferencing. A remote unauthenticated attacker can exploit this issue by sending a crafted read request, causing the device to crash (denial of service).

A reachable assertion vulnerability in Matter SDK (connectedhomeip) before 1.4.2 allows remote denial of service by sending a MoveToLevel command followed by writing OperationMode=2 in the Pump Configuration and Control cluster, causing a server crash.

In Rclone before version 1.74.4, a vulnerability exists in the `rclone serve restic --private-repos` component. The authorization mechanism uses the routed user path segment while building the backend object key from the raw uncleaned URL path, allowing an authenticated user to include `..` in a request (e.g., `//..//config`) and read, overwrite, or delete another user's private repository on backends that clean path components.

A vulnerability in jadx versions 1.5.2 to 1.5.5 allows writing files outside the intended temporary directory when extracting a malicious .xapk file. An attacker can place a JAR file into the plugins/dropins directory, which is loaded as a plugin on the next jadx run, enabling arbitrary code execution.

In Rclone prior to version 1.74.4, when using the -l/--links flag, symlinks are serialized as .rclonelink text objects and recreated on a local destination without validating the target. This allows an attacker-controlled remote to plant an escaping symlink and cause a subsequent object write to land outside the destination with attacker-chosen contents.

A vulnerability in Pi-hole versions 6.0 to 6.4.2 allows a user with code execution as the unprivileged pihole user to escalate privileges to root by replacing the /etc/pihole/logrotate file. The file is then processed by pihole-FTL-prestart.sh, which changes its ownership to root:root, and subsequently executed as root by the daily pihole flush cron, enabling arbitrary code execution with administrative privileges.

A vulnerability in the Twig template library for PHP allows bypassing the sandbox mechanism. The allow-list of filters, tags, and functions is computed when a template instance is created and may remain cached after sandbox state changes between renders.

A vulnerability in the Twig template engine for PHP before version 3.27.0 causes the 'column' filter to pass the sandbox state as a boolean but does not forward the current Source to SandboxExtension::checkPropertyAllowed(), so SourcePolicyInterface decisions are lost and a template author can read public or magic properties not allowed by the sandbox policy.

The vulnerability in CAI Content Credentials is caused by improper input validation, which could lead to a denial-of-service (DoS) condition. An attacker can exploit this flaw remotely without user interaction, causing the application to crash.

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application without user interaction.

Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CAI Content Credentials is affected by an Insufficiently Protected Credentials vulnerability that could result in disclosure of sensitive information. An attacker could leverage this vulnerability to gain unauthorized read access without user interaction.

An SSRF vulnerability in CAI Content Credentials could lead to arbitrary code execution in the context of the current user. An attacker can inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account. User interaction is required (visiting a crafted URL or interacting with a compromised page).

An Untrusted Search Path vulnerability in CAI Content Credentials could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction, such as visiting a malicious URL or interacting with a compromised web page. The scope of the vulnerability is changed.

Illustrator is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction as a victim must open a malicious file. The scope is changed.

A vulnerability in the Twig template library for PHP (versions 3.15.0 through 3.26.0) allows an attacker to inject PHP code via the _self.(<string>) and import-alias dynamic attribute syntax. Lack of identifier validation causes attacker-controlled strings to be emitted as raw PHP into the generated template source and executed at template-load time.