CVE Vulnerability Catalog

Prior to version 7.2.0, Semantic MediaWiki's Special:URIResolver redirects to a URL derived from the subpage without validating the target, allowing an open redirect to an off-host destination, potentially embedding credentials.

Prior to version 7.2.0, Semantic MediaWiki reflects the 'value' parameter in rendered output and error messaging paths without sufficient output-context encoding, allowing reflected XSS.

Prior to version 7.2.0, Semantic MediaWiki inserts the separator (parameter 'sep') verbatim into HTML cell joins, allowing HTML injection and potentially XSS.

Prior to version 7.2.0, when headers=plain is set, Semantic MediaWiki emits table header text into <th> via a raw HTML path. User-controlled 'mainlabel' content can become executable HTML.

Process Compose before version 1.120.0 has a vulnerability in the MCP SSE listener that accepts browser-origin requests without validating Host/Origin headers or authenticating the caller. A malicious website can use DNS rebinding to reach the loopback listener and issue MCP requests, potentially allowing process enumeration, log access, and process control if expose_control_tools is enabled. Fixed in version 1.120.0.

AnyCable before version 1.6.15 has a vulnerability in the telemetry subsystem that uses a hardcoded public auth token and generates a stable fingerprint from sensitive configuration data. Although raw credentials are not shown to leave the process, the fingerprint could be used for instance identification. Fixed in version 1.6.15.

AnyCable before version 1.6.15 has a vulnerability in the Pusher-compatible REST API where the body_md5 value is included in HMAC but not verified against the actual request body. An attacker with a valid signed POST request can replace the body, and the lack of auth_timestamp freshness check allows replay attacks. This can lead to forged server events, state modification, or delivering attacker-controlled messages to WebSocket clients. Fixed in version 1.6.15.

Capsule from version 0.13.0 to 0.13.7 has a vulnerability in the Tenant validation webhook where the new and old parameters are reversed, causing validation of the previous AllowedHostnames.Regex instead of the submitted value. A cluster administrator can store a malformed regex, which later blocks Ingress operations for the tenant. Fixed in version 0.13.7.

Capsule from version 0.13.0 to 0.13.7 has a vulnerability in Tenant update validation where ForbiddenLabels.Regex is compiled for both labels and annotations checks instead of validating ForbiddenAnnotations.Regex. An administrator can persist a malformed regex, which later causes regexp.MustCompile to panic during metadata validation and blocks namespace operations. Fixed in version 0.13.7.

Azkaban through version 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution times, cron expressions, flow parameters, and notification email lists.

Mealie before version 3.21.0 fails to validate user ownership in the ratings and favorites endpoints, allowing authenticated attackers to read any user's recipe ratings and favorites by specifying arbitrary user IDs in the URL path. Attackers can access private recipe identifiers, rating values, and favorite flags belonging to other users.

WinFsp through version 2.2.26215 contains a null pointer dereference vulnerability in the kernel driver's Fast I/O device control handler that fails to validate the volume context before use. An unprivileged local user can trigger a denial of service by opening the WinFsp control device and issuing FSP_IOCTL_TRANSACT requests, causing a system crash.

gedelumbung HospitalManagement up to version c2d45543789a3887067d3915f69d44cfc2cf76a8 has a vulnerability in the password change and profile functions where manipulation of the kode_user/username argument leads to improper authentication. The attack can be launched remotely, and the exploit has been publicly disclosed. The project has not responded.

gedelumbung HospitalManagement up to version c2d45543789a3887067d3915f69d44cfc2cf76a8 has a cross-site request forgery (CSRF) vulnerability in unknown code. The attack can be initiated remotely, and the exploit has been made public. The project has not responded.

Bransys ELD is shipped with hardcoded MQTT credentials. These credentials grant read access to real-time data for every active device across a subset of carriers connected to the affected MQTT broker.

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of unc_decoder::get_compressed_image_data_uncompressed() retains an addition-based range check that can wrap when a crafted uncompressed tile grid produces a large range_start_offset and range_size. The overflow makes the bounds comparison pass and allows heif_image_handle_decode_image_tile() to call memcpy() with an invalid source pointer and a very large length. This issue is fixed in version 1.23.3.

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32_MAX + 1 can reach crop calculations through heif_image_handle_get_image_tiling(). Box_clap::left_rounded() or Box_clap::top_rounded() passes the image dimension minus one to Fraction::Fraction(), whose uint32_t constructor uses an assertion as input validation, causing assert-enabled builds to abort. Release builds can instead compute invalid crop geometry, and the tiling API returns dimensions that the normal decode security limits reject. This issue is fixed in version 1.23.3.

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_region_inline_mask_data() function in libheif/api/libheif/heif_regions.cc accepts mask_data_len without verifying that it equals the byte count required by width and height. A later heif_region_get_mask_image() call derives the read length from the region geometry, so an undersized stored buffer causes heif_region_get_inline_mask_image() to read beyond the heap allocation and copy adjacent bytes into the returned monochrome mask image. This can disclose heap data or crash an application that constructs region metadata through the writer API, while the file-parsing path is not affected because it validates the canonical mask size. This issue is fixed in version 1.23.2.

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password hashing, a cryptographic algorithm with known weaknesses. An attacker who obtains the device configuration file can recover the privileged-mode access password.

Stack-based buffer overflow in the web server of PLANET IGS-5225-8P2T4S industrial managed switch firmware versions V1 and V2 before 1.2412b260707 and 2.2412b260519. Insufficient bounds checking on data copied into a stack buffer allows a remote administrator to cause a denial of service or potentially execute arbitrary code on the underlying operating system.