CVE Vulnerability Catalog

Zulip before version 11.6 has a path traversal vulnerability in ./manage.py import that allows reading arbitrary files from the server filesystem. A crafted export tarball causes file copying to the uploads directory during import.

In Zulip before version 11.6, even after disabling spectator access, attachments from web-public streams remained anonymously accessible. Additionally, the /users/me/<stream_id>/topics endpoint remained reachable anonymously, allowing retrieval of topic history for those streams.

prompts.chat prior to commit 1464475 contains a blind SSRF vulnerability in the Wiro media generator. Authenticated users can send POST requests to /api/media-generate with a controlled inputImageUrl parameter, allowing them to probe internal networks, access internal services, and exfiltrate data through the Wiro service.

A weakness has been identified in BookStackApp BookStack up to version 26.03 in the chapterToMarkdown function of app/Exports/ExportFormatter.php (Chapter Export Handler). Manipulating the pages argument can lead to improper access controls. The attack can be launched remotely and the exploit is publicly available.

A flaw in rust-rpm-sequoia allows an attacker to provide a crafted RPM file that triggers an error in OpenPGP signature parsing, causing unconditional termination of the rpm process and denial of service.

In NASA cFS up to version 7.0.0 on 32-bit, an integer overflow vulnerability was identified in the CFE_TBL_ValidateCodecLoadSize function. The attack is difficult to execute but could lead to unexpected system behavior.

NASA cFS up to version 7.0.0 has a vulnerability in the function CFE_SB_TransmitMsg in file cfe_sb_priv.c of the CCSDS Header Size Handler component that can lead to memory corruption. The project was informed but has not responded.

In NASA cFS up to version 7.0.0, a heap-based buffer overflow exists in the function CFE_MSG_GetSize in file apps/to_lab/fsw/src/to_lab_passthru_encode.c. The attacker must have local network access. The project was informed but has not responded.

NASA cFS up to version 7.0.0 has a vulnerability in the function pickle.load in the Pickle Module component that leads to deserialization. The attack requires local access and is considered difficult to exploit. The project was informed but has not responded.

The ProjectsAndPrograms School Management System up to version 6b6fae5426044f89c08d0dd101c7fa71f9042a59 contains an unrestricted file upload vulnerability in the Profile Picture Handler component in /admin_panel/settings.php. Manipulation of the File argument allows remote uploading of arbitrary files without proper restrictions.

In the mixelpixx Google-Research-MCP project, a server-side request forgery (SSRF) vulnerability was found in the extractContent function of content-extractor.service.ts. The attack can be performed remotely by manipulating the URL argument.

In the Linux kernel, a memory leak has been found in the cache_release function in the sunrpc subsystem. When a reader's file descriptor is closed while reading a cache_request (rp->offset != 0), cache_release() decrements the readers count but never checks whether it should free the request. This can lead to a memory leak if CACHE_PENDING is clear and readers drop to zero.

In the Linux kernel mac80211 subsystem, a crash occurs during channel switch (CSA) for stations on AP_VLAN interfaces (e.g., 4addr WDS clients). ieee80211_chan_bw_change() uses sta->sdata pointing to VLAN without channel reservation, causing a NULL pointer dereference.

In the Linux kernel, in the atmel-sha204a crypto driver, a ->tfm_count leak has been detected. If memory allocation fails, the counter is not decremented, which can block future reads.

In the Linux kernel drm/xe driver, a memory leak occurs in xe_vm_madvise_ioctl. When check_bo_args_are_sane() validation fails, previously allocated resources are not freed, causing a memory leak.

In FastMCP prior to version 3.2.0, a Confused Deputy vulnerability was found in the OAuthProxy component. During GitHub OAuth integration, the server does not properly validate user consent, which combined with GitHub skipping the consent screen enables an attack.

Budibase prior to version 3.23.25 lacks rate limiting or CAPTCHA on the password reset endpoint. An unauthenticated attacker can repeatedly trigger password reset requests for the same email, flooding the inbox with hundreds of emails.

In the Linux kernel, in the SPI subsystem, per-CPU statistics are allocated only after the controller is registered with the driver core, leaving a window where accessing sysfs attributes can trigger a NULL-pointer dereference. The fix moves statistics allocation to controller allocation time.

In the Linux kernel, a bug in the RedBoot partition table parser causes a buffer overflow warning and oops when CONFIG_FORTIFY_SOURCE is enabled with a recent compiler. The issue is due to using memcmp() instead of strcmp() for string comparison.

In the Linux kernel, a vulnerability in the serial core driver causes an infinite loop in handle_tx() for PORT_UNKNOWN ports. The uart_write_room() function returns a value greater than zero while uart_write() returns 0 when the transmit buffer (xmit_buf) is uninitialized, leading to a system hang.