CVE Vulnerability Catalog

Cotonti through version 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor who opens the link, including administrators.

Ghidra versions 9.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters without validating remaining buffer length. Attackers can craft malicious binaries containing strings or constant byte stores that end in multi-byte lead units to trigger out-of-bounds reads that crash the decompiler or leak adjacent heap memory into decompiled output.

Horilla before version 2.0.0 contains a CSRF vulnerability in the /attendance/approve-validate-attendance-request/ endpoint, where attendance state changes are performed via an HTTP GET before calling save(), so Django does not require CSRF validation. An unauthenticated attacker can cause a logged-in manager to make a top-level request that silently approves attendance with the victim's privileges and attributes the approval to the victim in the audit trail.

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output.

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.

Horilla from version 1.0.0 to 1.6.0 and 2.0.0 contains a vulnerability in the get_mail_preview handlers in recruitment/views/actions.py and employee/not_in_out_dashboard.py, which render user-controlled content with the full request object in the Django template context. An authenticated user with a valid CSRF token can use template attribute traversal to read request.user.password, request.META, and related-user attributes, exposing password hashes, personal data, and server request metadata.

Horilla in version 1.5.0-85 and earlier does not consistently authorize access in payroll/views/component_views.py in allowances_deductions_tab, view_single_allowance, and view_single_deduction before loading records selected by emp_id, allowance_id, or deduction_id. An authenticated employee can substitute those identifiers to read another employee's salary structure, allowance and deduction amounts, personal loan disbursements, and repayment schedules without owning the record or holding payroll-view permissions.

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes, retaining full control of the dashboard since tokens are verified only against a static JWT secret that is never rotated.

Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit unlimited password guesses without rate limiting, attempt counters, lockouts, or delays to gain full administrator access and modify application configuration.

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single unauthenticated request to consume provider quota or access sensitive configuration data.

The WikiLambda extension in MediaWiki contains an XSS (Cross-Site Scripting) vulnerability due to improper input neutralization during web page generation. The issue affects version 1.47.0-alpha and has been remediated on the master branch.

The UploadWizard extension in MediaWiki contains an XSS (Cross-Site Scripting) vulnerability due to improper input neutralization during web page generation. The issue affects versions from * before 1.46.1, 1.45.5, 1.43.10.

The FlaggedRevs extension for MediaWiki through version 1.46.0 fails to properly remove sensitive information before storage or transfer. This can lead to exposure of data that should have been redacted or removed.

PHP's OpenSSL stream peer verification checks subjectAltName entries first and falls back to Common Name when no entry matches. RFC 6125 requires CN to be ignored once the certificate presents any service identity, so a certificate with a non-matching DNS SAN was still accepted when its CN matched the requested peer_name.

php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation.

When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin.

phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine.

RustDesk versions before 1.5.0 fail to properly validate file transfer permissions on incoming file clipboard messages in the Cliprdr message handler on Linux and macOS. Authenticated remote peers with disabled file transfer permissions can place files onto the host clipboard and retrieve copied files and contents from the process-wide clipboard cache.

The Wikibase extension for MediaWiki contains a Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions before 1.46.1, 1.45.5, and 1.43.10.

The Wikipedia Android App exposes sensitive information to unauthorized actors, allowing access, interception, or modification of HTTP cookies. This issue affects the main branch of the application.