CVE Vulnerability Catalog

An out-of-bounds read vulnerability exists in the xls_dumpSummary() function of libxls 1.6.3 due to insufficient validation of file-controlled OLE summary offsets.

A heap-buffer-overflow and use-after-free vulnerability exists in the xls_getCSS() function of libxls 1.6.3 due to insufficient validation of a file-controlled font index.

An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges.

In Suricata prior to versions 7.0.16 and 8.0.5, Suricata could repeatedly perform expensive parsing of large HTTP Content-Disposition headers during HTTP response body processing. Crafted HTTP traffic could cause excessive CPU usage and denial of service.

A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow operating system commands to be executed if a local user opens a specially crafted link handled by the application.

A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application.

A potential improper permissions vulnerability was reported in the Lenovo Filez Client application that could allow a local authenticated user to escalate privileges.

The cstruct package before 6.3.0 for OCaml mishandles indexes.

OpenNMS Horizon is missing an authorization rule for the HTTP PATCH method in the Spring Security policy for the /api/v2 REST API. As a result, the event configuration and SNMP data collection endpoints are reachable without authentication, allowing an unauthenticated attacker to disable event definitions and SNMP data collection.

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function. A malicious Git server operator can pollute Object.prototype by advertising crafted ref names containing '__proto__' path segments during ref negotiation.

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver causes a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal identifier. An authenticated user who can influence the identifier may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed.

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver causes a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal identifier. An authenticated user who can influence the identifier may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed.

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver causes a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal identifier. An authenticated user who can influence the identifier may obtain stored file content beyond the intended target, cause all GridFS file chunks in the affected bucket to be removed, or rename a stored file other than the intended target.

Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh. When building Envoy RBAC rules to enforce Connect intentions, Consul did not correctly escape certain characters in service names, namespaces, and partitions, causing the generated authorization rules to match more broadly than intended.

The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events.

Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path. An authenticated attacker with a token granting node-write permission on any single node name may delete another node's catalog registration and take over its node identity if they can obtain its node ID.

zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser.

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity.

Tesseract version 5.5.3 and earlier contains a heap overflow vulnerability in Classify::ReadIntTemplates, which reads NumClassPruners, NumClasses, and NumProtoSets from a .traineddata file without validating them against MAX_* limits. Oversized values cause out-of-bounds pointer writes on the heap during classifier initialization.

Tesseract version 5.5.3 and earlier contains a heap overflow vulnerability in UNICHARSET::load_via_fgets, which trusts the declared unichar count as a loop bound and uses id as an unchecked index into the unichars vector. This can lead to out-of-bounds writes during initialization.