CVE Vulnerability Catalog

Some HikCentral Access Control versions contain an authorization flaw. An authenticated low-privilege user can invoke API interfaces that their role is not authorized to access.

t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from serialized data. Attackers can supply crafted serialized digests with mismatched header fields to trigger ArrayIndexOutOfBoundsException or NegativeArraySizeException, aborting the parsing thread.

ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the read_ID3_Header function due to a shadowed length parameter in ID3 synchronized-lyrics processing. Attackers can craft malicious MP3 files or HTTP audio streams with oversized frame size declarations to read past allocated buffer boundaries.

An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db endpoint misclassifies nested arrays when they contain an unrecognized stage key (e.g., $_internalInhibitOptimization), allowing a non-admin user to inject forbidden operators like $lookup and perform cross-collection joins into restricted collections.

Joomla Extension SP Property versions below 4.1.4 contain an unauthenticated stored cross-site scripting (XSS) vulnerability due to unescaped output in views and admin lists. Multiple template files rendered attributes and text values directly into HTML without contextual escaping.

Joomla Extension SP Property versions below 4.1.4 lack CSRF token verification in the property booking (properties.booking) and agent contact form submission (agents.sendmail) endpoints. These endpoints processed POST requests without verifying Joomla session anti-CSRF tokens.

GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, enabling remote exhaustion of memory, connection, and worker resources.

GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VLSVR request handlers, allowing an unauthenticated remote attacker to crash the VLSVR service.

GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and crash the discovery process.

GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ connections.

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update.

GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell commands through ConsumerReference.Address and execute arbitrary commands as root.

In GeoVision GV-LPC2211 V1.13, an administrator can set a WEP key containing shell syntax, allowing arbitrary commands to be executed as root.

In GeoVision GV-LPC2211 V1.13, an administrator can set a WPA-PSK containing shell syntax, allowing arbitrary commands to be executed as root when wireless configuration is applied.

In GeoVision GV-LPC2211 V1.13, an administrator can set a wireless SSID containing shell syntax, allowing arbitrary commands to be executed as root.

In GeoVision GV-LPC2211 V1.13, an administrator can set a PPPoE username that escapes a sourced shell configuration assignment and executes arbitrary commands as root.

In GeoVision GV-LPC2211 V1.13, an administrator can set a username containing shell metacharacters that are executed as arbitrary root commands when the stored username is later deleted.

In GeoVision GV-LPC2211 V1.13, a Guest user can overwrite device configuration and replace the administrator password through SSVR.

In crun, when built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. This is a regression in crun 1.29 and affects crun >= 1.29.

A heap-based buffer overflow in the PC bridge protocol decoder of BoschSensortec COINES_SDK (versions 2.10 through 2.12.2) allows attackers to cause a denial of service (process crash) or potentially execute arbitrary code. The decoder trusts the packet length field from the external device and forwards it to the host response queue without validating the destination buffer bounds; a malicious USB or BLE peripheral can advertise a payload size up to ~3 KB, exceeding the default queue slot size of 255 bytes, resulting in an unbounded heap overwrite.