CVE Vulnerability Catalog

A path traversal vulnerability exists in Erlang/OTP stdlib's zip functions (zip:unzip/1,2 and zip:extract/1,2) unless the memory option is used. This allows file manipulation outside the target directory.

In GIMP, the "Despeckle" plug-in has an integer overflow vulnerability. Unchecked multiplication of image dimensions (width, height, bytes-per-pixel) can cause insufficient memory allocation and out-of-bounds writes.

Cross-Site Scripting (XSS) vulnerability in Jetimob Plataforma Imobiliaria version 20240627-0. An attacker can inject malicious script via the "Profisso" field in the "Pessoas" section.

A Cross-Site Scripting (XSS) vulnerability was found in Jetimob Plataforma Imobiliaria version 20240627-0. The 'Descrico' form field in the 'Oportunidades' section during activity creation or editing allows JavaScript injection.

Cross-Site Scripting (XSS) vulnerability in Jetimob Plataforma Imobiliaria allows an attacker to inject malicious script into the 'Título' (title) field within the filter save option of the 'Busca' (search) function.

A Cross Site Scripting (XSS) vulnerability was found in Jetimob Plataforma Imobiliaria 20240627-0 in the 'Observaces' (observances) form field within the 'Pessoas' (persons) section when creating or editing a legal or natural person. An attacker can inject malicious JavaScript code that executes in the victim's browser.

In vulnerability CVE-2025-25250 in Fortinet FortiOS, an authenticated user can access full SSL-VPN settings via a crafted URL. This affects FortiOS versions 7.6.0, 7.4.0 through 7.4.7, as well as all versions of 7.2, 7.0, and 6.4, and FortiSASE 25.1.c.

FortiOS versions 7.6.1 and below, and 7.4.7 and below, have an Improper Certificate Validation vulnerability. This may allow an EAP verified remote user to connect from FortiClient using a revoked certificate.

FortiOS SSL-VPN has an insufficient session expiration vulnerability that allows an attacker with a cookie used for login to log in again, even if the session has expired or was logged out.

A heap buffer over-read vulnerability has been identified in the libarchive library. The issue occurs when the size of a filter block exceeds the LZSS window, potentially causing the library to read beyond allocated memory, leading to unpredictable behavior, crashes, or disclosure of sensitive information.

A stored cross-site scripting (XSS) vulnerability in Anchor CMS v0.12.7 allows attackers to inject malicious JavaScript via the page description field in the page creation interface (/admin/pages/add).

A vulnerability in the nbdkit "blocksize" filter allows a malicious client to trigger an internal error by requesting block status information for an excessively large data range. This leads to a denial of service (DoS) of the nbdkit server.

A flaw exists in the nbdkit server when handling plugin responses about data block status. If a client requests a very large data range and a plugin responds with an even larger single block, the server may encounter a critical internal error, leading to a denial-of-service.

A flaw in Samba causes the smbd daemon to ignore group membership changes when re-authenticating an expired SMB session. This can expose file shares until clients disconnect and reconnect.

A vulnerability in Qt causes a crash when loading a specially crafted ICNS image file via QImage. Affects Qt versions 6.3.0 through 6.5.9, 6.6.0 through 6.8.4, and 6.9.0. Fixed in 6.5.10, 6.8.5, and 6.9.1.

A cross-site request forgery (CSRF) vulnerability was found in WuKongOpenSource WukongCRM 9.0 in the file /system/user/updataPassword. The attack can be launched remotely, and exploit details have been publicly disclosed.

A vulnerability in Python's tarfile module allows modifying file metadata or permissions outside the extraction directory when using filters 'data' or 'tar'. Affects Python 3.12+.

A vulnerability in systemd-coredump allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump. This enables reading sensitive data, such as /etc/shadow content, loaded by the original process.

A vulnerability in the mcp-markdownify-server package before version 1.0.0 allows unauthorized access to files and directories on the server via the get-markdown-file tool. An attacker can craft a malicious prompt that, when processed by the MCP host, enables reading arbitrary files from the system.

In GNU Coreutils, the begfield() function in the sort utility is vulnerable to a heap buffer under-read. A crafted command using the traditional key format may access memory outside the allocated buffer.