CVE Vulnerability Catalog

A stored cross-site scripting (XSS) vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE: This has been disputed by the vendor since this potential attack is only possible via authenticated users who have been manually allowed access to the CMS. There was a deliberate decision made not to apply HTML sanitization at the product level.

An uninitialized pointer dereference in the ngap_handle_pdu_session_resource_setup_response routine of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDU Session Resource Setup Response.

In multiple locations, there is a possible way to access media content belonging to another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.

A null dereference vulnerability in OpenAirInterface CN5G AMF (oai-cn5g-amf) version 2.0.0 and earlier occurs when handling unsupported NGAP protocol messages. An attacker with network-adjacent access can trigger a denial of service.

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0.25 store web pages locally, allowing another system user to read them.

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0.25 do not restrict domains in CORS, potentially allowing an attacker to perform privileged actions and retrieve sensitive information.

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0.25 use weaker than expected cryptographic algorithms, potentially allowing an attacker to decrypt highly sensitive information.

In the Linux kernel's io_uring/eventfd subsystem, a vulnerability was found where io_eventfd_do_signal() called from an RCU callback may directly free the io_ev_fd structure instead of deferring it to another RCU grace period. This could lead to use-after-free or other memory errors.

In the Linux kernel, a vulnerability was found due to overly strict assertions (WARN_ON) when file handle encoding fails. These assertions are incorrect because encoding can fail for various reasons, and main users (nfsd, name_to_handle_at) are already prepared to handle errors.

In the Linux kernel, a vulnerability in the netfilter conntrack module allows the hashtable size to exceed INT_MAX during resize, triggering a WARN_ON_ONCE in __kvmalloc_node_noprof() due to missing __GFP_NOWARN flag. This issue is limited to the init_netns namespace.

A vulnerability in the Linux kernel's AMD PMC driver (platform/x86/amd/pmc) causes an unbalanced IRQ1 wake disable when i8042 did not enable the wakeup, leading to a WARN() warning and potential wake_depth underflow.

A Cross-Site Scripting (XSS) vulnerability was found in sunnygkp10 Online Exam System master version. It allows a remote attacker to steal sensitive information via the 'w' parameter.

A path traversal vulnerability in Fortinet FortiRecorder, FortiVoice, and FortiWeb allows an attacker to escalate privileges via specially crafted packets.

A race condition was found in rsync's handling of symbolic links. By default, rsync skips symbolic links, but an attacker can replace a regular file with a symbolic link at the right moment to bypass this behavior and traverse symbolic links.

A flaw in rsync causes the client to improperly verify symbolic link destinations when using the `--safe-links` option, allowing path traversal and arbitrary file write outside the intended directory.

A path traversal vulnerability was found in rsync, caused by the `--inc-recursive` option (enabled by default for many clients and can be forced by the server). Insufficient symlink verification combined with per-file-list deduplication checks allows a server to write files outside the client's intended destination directory.

A flaw was found in rsync that could allow a server to enumerate the contents of an arbitrary file from the client's machine. The issue occurs during file copy from client to server when the server sends checksums of local data for comparison. An attacker can send specially crafted checksum values and reconstruct the data byte-by-byte based on client responses.

A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer and FortiManager allows a remote attacker to execute unauthorized code or commands via specially crafted packets. The issue affects multiple versions of these products, including cloud variants.

A privilege management vulnerability in Fortinet FortiManager and FortiManager Cloud allows unauthorized privilege escalation via specific shell commands. Affected versions include 7.4.0-7.4.3, 7.2.0-7.2.5, 7.0, and 6.4.

A vulnerability in Vim may lead to a heap-buffer overflow when switching to other buffers with visual mode still active. The issue arises from the improper ending of visual mode, which may result in attempts to access memory beyond the end of a line in a buffer.