CVE Vulnerability Catalog

CordysCRM prior to version 1.7.2 allows unauthenticated access to the GET /mcp/form/config/{formKey} endpoint due to ShiroFilter marking /mcp/** as anonymous and missing permission annotations. An unauthenticated caller can obtain field names, types, validation rules, and binding sources for CRM modules, enabling reconstruction of the application data model.

pg_partman prior to version 5.5.0 has a vulnerability in run_maintenance() where exceptions are handled outside the loop processing rows from part_config. An exception for one partition set immediately terminates the loop and skips later sets. A role with partman_user access can insert or update a row that reliably fails and assign it a low maintenance_order value to be processed before legitimate rows.

FluidSynth versions 2.5.0 through 2.5.6 have a vulnerability in the native DLS parser where ptbl chunk validation uses the expression cues * 4 + cbsize without checking for 32-bit overflow. A crafted DLS file can wrap the expression and pass the chunk-size check, causing poolcues.resize(cues) to request about four gigabytes and read billions of entries beyond the chunk boundary.

FluidSynth versions 2.5.0 through 2.5.6 have a vulnerability in the native DLS parser where articulation chunk validation uses the expression cbsize + connblocks * 12 without checking for 32-bit overflow. A crafted DLS file can wrap the expression and bypass the chunk-size check, leading to approximately one billion 12-byte iterations beyond the chunk boundary.

FluidSynth versions 2.5.0 through 2.5.6 have a vulnerability in the SF2 parser where the DMOD modulator count is computed as chunk.size / SF_MOD_SIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file with a zero-sized DMOD chunk makes the unsigned subtraction wrap to UINT_MAX, and the parser then attempts billions of SFMod allocations.

Suricata versions 8.0.0 through 8.0.6 have a vulnerability in the DHCP and RDP parsers where stateless transactions are created without recording packet direction with AppLayerTxData::for_direction(). A sensor observing only one direction cannot mark the unseen direction inspected or free completed transactions, causing the per-flow transaction list to grow without bound.

Suricata prior to versions 7.0.17 and 8.0.6 has a vulnerability in src/ippair.c where crafted IPv4 and IPv6 address pairs can collide in the IPPair hash because the IP address family was not compared before reusing IPPair-backed state. This can apply state from one IP family to another for xbits track ip_pair, FTP data expectations, and, on the 7.0 release line, thresholding, detection_filter, and rate_filter rules using track by_both.

CordysCRM prior to version 1.7.0 has a time-based blind SQL injection vulnerability in the POST /account-pool/page endpoint. An authenticated caller with MODULE_SETTING:UPDATE can place a crafted sort.name value into a dynamic SQL ORDER BY expression without strict server-side validation.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions and access internal network services due to improper validation of FTP PORT and EPRT commands.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to improper validation of FTP authentication commands.

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability.

IBM WebSphere Application Server 9.0 and 8.5 is affected by a deserialization vulnerability in the Name Service component.

IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers.

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by a virtual host bypass vulnerability. The flaw allows bypassing controls based on virtual host configuration.

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability.

IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet.

IBM WebSphere Application Server 9.0 and 8.5 is affected by an authentication bypass vulnerability in the SOAP/JMX connector.

In osmo-ggsn 1.14.0, an out-of-bounds write issue was found in the gtp_decode_pdp_ctx() function through the PDP context GSN-Address sub-field, leading to memory corruption.

Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error or warning.

A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext, without any error or warning.