CVE Vulnerability Catalog

An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicious servers to crash the X client.

OpenWA before version 0.23.5 allows a user with a VIEWER key to retrieve a group invite code without the OPERATOR role requirement. The invite code is transferable, so an unauthorized account can join the group, read and post messages, and retain membership after the VIEWER key is revoked.

Discourse before certain versions allowed a stored cross-origin iframe to bypass the allowed_iframes prefix policy when the iframe src contained encoded userinfo. An authenticated user with posting privileges could persist the iframe in a post, causing attacker-controlled cross-origin content to be rendered.

Discourse before certain versions allowed authenticated users to supply unescaped SQL LIKE wildcard characters in upload-resolution patterns, causing unrelated upload records to be selected. Access to restricted metadata, including original filenames and secure-upload paths, was possible without modifying the records.

Discourse before certain versions, when wildcard patterns were used in the allowed_iframes setting, could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The origin check was bypassed, and the browser selected a different attacker-controlled origin, allowing an attacker-controlled iframe to be rendered.

Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText() to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulting in a persistent memory leak on each parsing attempt.

OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL packed_data pointer. The OpaqueAttribute constructor passes the NULL pointer to memcpy() without validating the zero-size condition, resulting in undefined behavior and process termination.

libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination.

Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration atom parsers. A specially crafted MP4 file containing an atom with a declared size smaller than AP4_ATOM_HEADER_SIZE can cause AP4_AvccAtom::Create() or AP4_HvccAtom::Create() to underflow the payload-size calculation. The resulting oversized buffer operation can cause invalid or NULL pointers to be passed to the AP4_DataBuffer copy path, resulting in application termination.

NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__curveDivs() during SVG stroke rasterization. A specially crafted SVG document containing an extremely large stroke-width can cause floating-point rounding to produce a zero subdivision angle. The subsequent arc division yields infinity, which is converted to int without range validation, resulting in undefined behavior and process termination.

Discourse before certain versions allowed Discourse AI reviewables associated with private messages to appear in the moderator review queue of a moderator who was not a participant. Visibility filtering did not restrict access, allowing the moderator to read confidential content and potentially modify the private message by closing the topic or deleting a post.

Termix from version 2.4.0 to 2.5.1 accepted the account password as the sole reauthentication factor in endpoints for disabling TOTP and regenerating backup codes. The refactor regressed the two-factor check, allowing an attacker with a victim's session and knowledge of the password to disable 2FA without access to an authenticator.

Termix from version 1.7.0 to 2.5.1 derived keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt. An attacker with an offline SQLite database copy can derive the wrapping key and decrypt stored SSH passwords, private keys, and key passphrases.

phpMyFAQ before version 4.2.0-alpha is vulnerable to SQL LIKE wildcard injection in the chat user search. An authenticated user can bypass the display-name search filter and enumerate active users, as % and _ are not escaped.

SumatraPDF before version 3.6 has a vulnerability in the MobiDoc::ParseHeader function, where the decoder is sized for a fixed length rather than the actual buffer length. A malformed MOBI file can cause a read beyond a short heap buffer, leading to application crash.

DbGate up to version 7.2.5/7.3.1-premium-beta.1 has a path traversal vulnerability in the fs.readFile function in packages/api/src/controllers/files.js. Manipulation of the filePath/uri arguments allows an attacker to remotely read arbitrary files outside the allowed directory.

A code injection vulnerability was found in DbGate up to version 7.2.5-beta.5 in the JSON Runner component. Manipulating the comment.text/script.schedule arguments in packages/api/src/controllers/runners.js can lead to remote code execution. Upgrading to version 7.2.5-beta.6 mitigates the issue.

A reflected XSS vulnerability exists in the CirrusSearch extension for MediaWiki due to improper input neutralization during web page generation. The issue affects versions up to and including 1.46.0.

An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party controlling name resolution and host responses to write beyond a heap buffer, potentially causing the application to terminate unexpectedly.

A deserialization vulnerability in the command monitoring support of the MongoDB PHP Driver can cause class names from document content to be honored when building monitoring events. An attacker controlling data in database operations may instantiate application classes implementing the persistable interface and invoke their unserialize method.