CVE Vulnerability Catalog

A vulnerability in BeyondTrust Remote Support and Privileged Remote Access allows an unauthenticated remote attacker to trigger a denial-of-service (DoS) condition due to insufficient validation of client-supplied input in the network communication subsystem.

A critical pre-authentication vulnerability in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. Improper validation of authentication data may allow a network-positioned attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled.

In DrawIO for ownCloud prior to version 1.0.2 (corresponding to ownCloud 10 prior to 10.15.3), a stored XSS vulnerability was found. Attackers with access to the DrawIO app can inject malicious code due to improper input neutralization during page generation.

In the pnpm package manager prior to versions 10.34.4 and 11.7.0, a crafted lockfile alias could be placed directly under a hoisted node_modules directory. Traversal aliases could escape that directory, while reserved aliases such as .bin or .pnpm could overwrite pnpm-owned layout.

pnpm before versions 10.34.4 and 11.8.0 accepts package names from the configDependencies section of pnpm-lock.yaml and uses them directly when creating config dependency symlinks under node_modules/.pnpm-config. A malicious repository can supply a crafted lock file containing a traversal-shaped config dependency name, leading to symlink creation outside the intended directory.

In pnpm prior to versions 10.34.4 and 11.7.0, a crafted patch entry could resolve outside the configured patches directory, allowing arbitrary file deletion via the pnpm patch-remove command.

In ownCloud 10 prior to version 10.15.3, a path traversal vulnerability allows an attacker with administrative privileges to execute arbitrary code. The issue is fixed in version 10.15.3.

In SharePoint for ownCloud prior to version 0.4.1 (corresponding to ownCloud 10 before 10.15.3), an SSRF vulnerability allows an attacker with administrative privileges to execute arbitrary code on the system.

An off-by-one error was found in GIMP's PNM file format parser in the pnmscanner_gettoken() function. When parsing a crafted PNM file, a null terminator is written one byte past the end of a stack buffer, leading to memory corruption.

A memory leak vulnerability in OpenVPN versions 2.5.0–2.5.11, 2.6.0–2.6.20, and 2.7_alpha1–2.7.4 allows a remote attacker with a valid tls-crypt-v2 client key to cause a denial of service (DoS).

A vulnerability in Imager::File::JPEG for Perl before version 1.003 causes heap memory leak when reading JPEG files with multiple APP13 markers. The i_readjpeg_wiol function allocates a new buffer for each marker but does not free the previous one, leading to accumulated leaks.

In the Imager library for Perl before version 1.032, there is a heap out-of-bounds read vulnerability in the Imager::File::SGI module. The issue is in the read_rgb_16_rle function, which incorrectly checks the pixel count in an RLE run, leading to a read past the buffer. An attacker can exploit this by providing a crafted SGI image, potentially causing a process crash.

An Untrusted Search Path vulnerability has been discovered in B&R Industrial Automation GmbH APROL software. This issue affects versions prior to R 4.4-01P5.

An improper certificate validation vulnerability has been discovered in B&R Industrial Automation GmbH APROL. This issue affects APROL versions before R 4.4-01P5.

An inefficient algorithmic complexity vulnerability in the hpax library for Elixir allows unauthenticated denial-of-service via unbounded HPACK integer decoding. An attacker can send a small HTTP/2 header block that forces excessive CPU and memory usage. This affects hpax versions from 0.1.1 before 1.0.4.

A vulnerability in the Mint library (Mint.HTTP1 module) allows a remote server to exhaust client memory by sending a chunked transfer-encoded response with a declared huge chunk size (e.g., 2 GiB) and slowly sending data without ever completing the chunk. The client buffers all received bytes without emitting them to the caller, leading to uncontrolled memory growth and out-of-memory conditions.

The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service condition.

A vulnerability in Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` allows writing files outside the intended destination directory. An attacker with write access to the source GCS bucket can create an object with `..` segments in its name, leading to overwrite of arbitrary files on the SFTP server or the worker host.

Improper Input Validation vulnerability in Apache Camel. The flaw allows potential attacks via malicious input data.

An improper input validation vulnerability has been discovered in Apache Camel. This flaw allows an attacker to inject malicious data, potentially leading to unexpected application behavior.