CVE Vulnerability Catalog

A buffer overflow vulnerability in the UTT nv518G router running firmware version nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service (DoS) via the gohead/sub_448384 component.

An improper input validation in the gazebo_ros_diff_drive.cpp component of gazebo_plugins v3.9.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted geometry_msgs::Twist message.

A NULL pointer dereference vulnerability was found in the AP4_AtomSampleTable::GetSample() function of MPC-BE before commit 4341cb3. An attacker can exploit a crafted MP4 file to cause a Denial of Service (DoS) by crashing the application.

Jodit Editor versions before 4.12.28 contain an XSS vulnerability due to bypass of the clean-html sanitizer. An attacker can use MathML or <style> as a carrier to hide a dangerous element from the sanitizer, allowing onload or onfocus events to be placed in the editor. When the application renders the editor content, JavaScript code executes without user interaction.

A vulnerability in the Tina headless CMS allows stored XSS and session takeover via unverified postMessage handlers and insufficient URL sanitization in rich-text content. An attacker can forge messages to hijack an authenticated editing session.

The mchange-commons-java library prior to version 0.6.0 has a vulnerability in its JNDI ObjectFactory implementation (JavaBeanObjectFactory) that allows constructing objects of arbitrary classes and initializing their JavaBean-style properties. For certain classes like Swing JEditorPane, this enables HTTP requests to arbitrary URLs, which can be exploited for JNDI injection and deserialization attacks.

A Remote Code Execution vulnerability exists in @tinacms/cli prior to version 2.4.3 during the Forestry-to-Tina migration. The addVariablesToCode helper unsafely processes user-supplied label and name fields from .forestry/**/*.yml, allowing arbitrary JavaScript injection into the generated tina/templates.{ts,js} file.

A Use-After-Free vulnerability in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code remotely over a network.

A vulnerability in NodeBB allows a remote attacker to impersonate any local user, including the administrator, by forging posts and private messages via the ActivityPub protocol. The issue stems from missing validation that the authenticated remote actor is the actual author of the ActivityPub object.

Ladybird contains a dangling-reference memory-safety flaw in its WebAssembly ESM-integration module loader. A JavaScript function imported into a WASM module via ESM causes a stack-local FunctionType to be destroyed after the link-loop iteration ends, while the host callback still references it, leading to memory corruption.

A deserialization vulnerability in the RemoteQueryCachePlugin of AWS Advanced JDBC Wrapper versions 3.3.0 through 4.0.0 allows arbitrary code execution via untrusted data from Redis or Valkey cache. An attacker with write access to the shared cache infrastructure can inject a crafted Java object that, when read by the application server, triggers code execution.

A path traversal vulnerability in the FileExplorer component of Gradio before version 6.16.0 allows unauthenticated attackers to read files outside the configured root directory. Attackers can use traversal sequences or absolute paths that cause os.path.join to discard the root_dir prefix.

Dell Device Management Agent (DDMA) versions prior to 26.05 contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

OS command injection vulnerability in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cdk-lib. An attacker controlling dependency version strings in package.json can execute arbitrary commands on the CDK toolchain host via injected shell metacharacters.

An insertion of sensitive information into sent data vulnerability in HubSpot allows retrieval of embedded sensitive data. This issue affects HubSpot from n/a through 11.3.51.

A CSRF vulnerability in VikBooking Hotel Booking Engine & PMS allows an attacker to perform operations leading to Path Traversal. This issue affects all versions up to and including 1.8.12.

A vulnerability in the HTTP/2 HPACK decoder in Apache HttpComponents Core (versions 5.4.2 and earlier, 5.5-beta1 and earlier) allows a remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement applies the configured header list size limit.

CWE-117 vulnerability in Kibana allows injection of unsanitized data into logs. An attacker can supply specially crafted input that is written to log files without proper neutralization. When logs are viewed in a terminal that interprets control sequences, the injected content may alter the displayed log data.

In containerd prior to versions 1.7.32, 2.0.9, 2.2.4, and 2.3.1, containers with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username. This allows bypassing the Kubernetes runAsNonRoot restriction if a crafted image maps this large numeric string to root in /etc/passwd, causing the container to run as root (UID 0).

JAIOTlink C492A-W6 Wi-Fi IP cameras with firmware 4.8.30.57701411 contain a remote code execution vulnerability. An authenticated attacker can write a malicious script to persistent JFFS2 storage and trigger execution via an HTTP endpoint, achieving persistent control over the device.