CVE Vulnerability Catalog

TYPO3 HTML Sanitizer, an HTML sanitizer tool, has an encoding issue in the serialization layer that allows malicious markup nested in a `noscript` element to be incorrectly encoded. Although `noscript` is disabled by default, it may be enabled in custom configurations, allowing bypassing of the XSS protection mechanism.

TYPO3 is a PHP-based content management system that had a vulnerability in versions from 9.4.0 to 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4, allowing out-of-scope access to content in multi-site scenarios. This enabled visitors to access internal site content by manipulating HTTP query parameters in the URL.

Armeria, a microservice framework supported by Spring, had an issue with handling matrix variables in versions prior to 1.24.3. As a result, Armeria decorators might not be invoked, allowing an attacker to bypass authorization by sending a specially crafted request.

Certifi, a collection of root certificates for SSL verification, prior to version 2023.07.22 recognized 'e-Tugra' root certificates. Following reports of security issues in 'e-Tugra' systems, these certificates were removed from the root store in version 2023.07.22.

Cal.com is scheduling software that has a vulnerability allowing active sessions to remain after enabling 2FA. When 2FA is activated on an account logged in on two or more devices, the other device(s) remain logged in without requiring identity verification.

Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows local privilege escalation (LPE) for low privileged users, if already installed.

Vyper is a Pythonic programming language targeting the Ethereum Virtual Machine (EVM). Prior to version 0.3.10, the ecrecover precompile did not fill the output buffer if the signature did not verify, potentially leading to false signature verification results.

A vulnerability was found in phpscriptpoint Lawyer 1.6, affecting some unknown functionality of the file page.php. The manipulation leads to cross site scripting (XSS) attacks that can be launched remotely.

Pligg CMS v2.0.2 (also known as Kliqqi) was discovered to contain a remote code execution (RCE) vulnerability in the component admin_editor.php.

Plexis Archiver prior to version 4.8.0 has a vulnerability that allows arbitrary file creation and potentially remote code execution during archive extraction. The issue occurs when extracting an archive that involves a symbolic link whose target does not exist.

DataEase is a data visualization analysis tool that prior to version 1.18.9 had a SQL injection vulnerability allowing bypass of blacklists. The vulnerability has been fixed in version 1.18.9.

DataEase is a data visualization analysis tool that prior to version 1.18.9 had a stored cross-site scripting (XSS) vulnerability in the panel and dataset. The vulnerability has been fixed in version 1.18.9.

An arbitrary file upload vulnerability in eoffice before v9.5 allows attackers to execute arbitrary code via uploading a crafted file.

In version 13.0.50.20220805-git of GNU gdb (GDB), a heap buffer overflow was discovered in the function pe_as16() in the file /gdb/coff-pe-read.c.

In version 13.0.50.20220805-git of GNU gdb (GDB), a heap use after free vulnerability was discovered in the add_pe_exported_sym() function in /gdb/coff-pe-read.c.

In version 13.0.50.20220805-git, GNU gdb (GDB) was found to contain a stack overflow in the ada_decode function in /gdb/ada-lang.c.

Sentry is an error tracking and performance monitoring platform. In versions 8.21.0 through 23.5.2, an authenticated user could download a debug or artifact bundle from any organization and project with a known bundle ID, without needing permissions.

Contao is an open source content management system. In versions from 4.0.0 to 4.9.42, 4.13.28, and 5.1.10, untrusted backend users can inject malicious code into headline fields, which will be executed both in the element preview and on the website.

There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution. By sending specially crafted packets to the PAPI UDP port (Aruba's access point management protocol), it is possible to gain access to the operating system as a privileged user.

Multiple underlying services contain buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets to the PAPI UDP port (Aruba's access point management protocol). Successful exploitation of these vulnerabilities allows arbitrary code execution as a privileged user on the underlying operating system.