CVE Vulnerability Catalog

A local privilege escalation vulnerability in the pdfforge PDF Architect activation-service Update Service due to an uncontrolled search path element. The activation-service process loads a library from an unsecured location. An attacker must first obtain the ability to execute low-privileged code on the target system.

A remote code execution vulnerability in pdfforge PDF Architect due to an out-of-bounds write during PDF file parsing. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. User interaction is required: the target must visit a malicious page or open a malicious file.

A remote code execution vulnerability in pdfforge PDF Architect due to memory corruption during PDF file parsing. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. User interaction is required: the target must visit a malicious page or open a malicious file.

A remote code execution vulnerability in pdfforge PDF Architect due to an out-of-bounds write during PDF file parsing. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. User interaction is required: the target must visit a malicious page or open a malicious file.

A remote code execution vulnerability in pdfforge PDF Architect due to an out-of-bounds read during the handling of App objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. User interaction is required: the target must visit a malicious page or open a malicious file.

In the Joomla extension J2Store, any order can be marked Failed by anyone without authentication. An attacker can mass-fail pending orders to disrupt revenue and force manual reprocessing, or flip already-fulfilled orders back to FAILED to cause operational confusion. Unlike the earlier confirmation-fraud issue, this requires no correct payment amount or transaction data at all.

In the Joomla extension J2Store, J2StoreModelOrderdownloads::getFilePath() built the on-disk path to a purchased digital download by concatenating the configured attachment folder with the product file's stored product_file_save_name, using only JPath::clean() (which normalises separators but does not resolve or reject .. segments) and a plain JFile::exists() check. If a product file's product_file_save_name contained a ../ traversal segment, any customer holding a valid download token/pid pair could have the traversal resolve to a path outside the attachment folder and download any file readable by the web server (e.g. configuration.php).

The Joomla extension J2Store (versions 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7) contains an unauthenticated blind SQL injection vulnerability in the storefront product list. An attacker can remotely extract arbitrary database content, such as customer records, order data, or stored tokens, using boolean- or time-based inference.

Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.users.edit permission to escalate to full administrator. The user-update endpoint does not verify that the actor is permitted to grant the requested role, does not prevent a user from changing their own role, and does not restrict assignment to roles whose permission set is a subset of the actor's own.

In Webkul Bagisto v2.4.9, improper validation of the quantity parameter in the add-to-cart path allows authenticated attackers to reduce their order total below the legitimate price of shippable goods.

The Joomla extension J2Store (versions 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7) lacks CSRF protection on cart, checkout, and profile controllers. A forged request riding a victim's active session can silently overwrite billing or shipping address before order confirmation, potentially redirecting goods to an attacker-controlled address.

Http4s (versions prior to 0.23.35 and 1.0.0-M47) has a memory exhaustion vulnerability in the Ember HTTP/2 server. An unauthenticated HTTP/2 client can send PING, SETTINGS, or DATA frames that cause the server to enqueue acknowledgments or WINDOW_UPDATE frames faster than they are written, leading to heap memory exhaustion.

Http4s (versions prior to 0.23.35 and 1.0.0-M47) has a memory exhaustion vulnerability in the shared WebSocket decoder. The decoder allows unbounded message buffering because defragmentation accumulates fragments without a limit and FrameTranscoder accepts declared lengths up to Int.MaxValue. A remote client that completes a WebSocket handshake can exhaust server memory.

Http4s (versions prior to 0.23.35 and 1.0.0-M47) has a memory exhaustion vulnerability in the DigestAuth server middleware. Due to an inverted stale-nonce comparison, the middleware does not remove fresh nonces and stops eviction at the first stale nonce. An unauthenticated attacker can repeatedly trigger authentication challenges, causing the persistent nonce map to grow until the JVM exhausts heap memory.

In multiple functions of arm-smmu-v3.c, there is a logic error that may lead to privilege escalation. Exploitation requires local access and needs no user interaction or additional execution privileges.

In multiple locations, improper input validation may lead to privilege escalation. Exploitation requires local access and needs no user interaction or additional execution privileges.

In google_mba_recv_msg of google_mba_poll.c, a race condition leads to an out-of-bounds write. This may result in local privilege escalation with no user interaction or additional execution privileges required.

In ARM64_TLBI of mmu.h, a race condition leads to memory corruption. This may result in local privilege escalation with no user interaction or additional execution privileges required.

In multiple locations, a race condition leads to a use-after-free. This may result in local privilege escalation with System execution privileges required.

In DecodeFilmGrainParams of film_grain_dec.cc, a missing bounds check leads to an out-of-bounds write. This may enable remote code execution with no user interaction or additional execution privileges required.