CVE Vulnerability Catalog

Cross-site scripting vulnerability in Webkul Bagisto up to 2.4.4, in the file /customer/account/rma/send-message of the RMA Message Handler component. Manipulation of the Message argument allows remote script execution in the browser. The exploit has been publicly disclosed.

Vulnerability in DualSafe Password Manager & Digital Vault extension up to 1.4.35 on Chrome, affecting an unknown function of the postMessage-based Bridge component. Manipulation leads to information disclosure. The attack can be launched remotely but is difficult to exploit. The exploit has been published.

A weakness has been identified in Azuriom CMS up to version 1.2.12. This affects the function transferMoney of the file app/Http/Controllers/ProfileController.php of the Money Transfer Handler component. The manipulation causes a time-of-check time-of-use issue. The attack can be initiated remotely but requires high complexity.

A vulnerability was determined in automad up to version 2.0.0-beta.32. This affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the Password Reset Endpoint component. Manipulation of the argument name-or-email causes an observable response discrepancy. The attack can be initiated remotely but is difficult.

A vulnerability was detected in TrailDB 0.6. It affects the tdb_open function in /src/tdb.c of the TOC Validation component. The manipulation results in an out-of-bounds read. The attack can be launched remotely and the exploit is public.

OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation, degrading system performance and preventing timely completion of the init process.

A security flaw was discovered in code-projects Online Shopping System 1.0 in the file /checkout.php. Manipulating the amount_1 argument results in cross site scripting. The attack can be initiated remotely, and the exploit is public.

A vulnerability was detected in the Online Food Order System 1.0 by code-projects. It affects an unknown function in the file edit_food_items.php. Manipulation of the argument dname leads to cross-site scripting. The attack can be performed remotely, and the exploit is publicly available.

A weakness was identified in pkp-lib versions 3.3.0, 3.4.0, and 3.5.0. It affects the setData function in the file classes/user/form/APIProfileForm.php, related to API Key Generation. Manipulation of the apiKey argument leads to insufficient entropy. The attack can be performed remotely but has high complexity and is difficult to exploit. A patch is available with ID 529b5df878e571ccc727647f7748eafc1466b041.

A vulnerability was found in SourceCodester Online Book Store System 1.0. It affects unknown code in the file /admin/index.php?page=site_settings of the System Settings Module. The manipulation leads to cross-site scripting. The attack can be executed remotely, and the exploit is publicly available.

In VictoriaMetrics up to version 1.146.0, a vulnerability was found in the VMAuth Authentication Endpoint component, in the requestHandler function of app/vmauth/main.go. The issue is improper restriction of excessive authentication attempts, allowing brute-force attacks. The attack is remote but requires high complexity. Upgrading to version 1.147.0 is recommended.

In the dtale tool (mangroup) up to version 3.22.0, a vulnerability was found in the Login function in dtale/auth.py. The issue is improper restriction of excessive authentication attempts, allowing brute-force attacks. The attack is remote but has high complexity. The exploit has been published, and the project has not responded.

In the dtale tool (mangroup) up to version 3.22.0, a vulnerability was found in the build_secret_key function in dtale/app.py, related to Flask session cookies. The issue is insufficiently random values, which may allow an attacker to predict the session key. The attack is remote but requires high complexity. The exploit has been published, and a pull request with a fix awaits acceptance.

In the Open Source Point of Sale (opensourcepos) up to version 3.4.2, a vulnerability was found in the Login::index function in app/Config/Filters.php. The issue is improper restriction of excessive authentication attempts, allowing brute-force attacks. The attack is remote but requires high complexity. The exploit has been published, and the project has not responded.

A vulnerability in the D-Link DIR-842 router (version 2.01.B04) affects an unknown function in the /etc/vsftpd.conf file of the vsftpd component. Manipulation leads to incorrect default permissions. The attack can be launched remotely but has a high complexity level and is considered difficult to exploit.

A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. It affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggressive Mode. Manipulation of the argument exchange_mode causes missing encryption of sensitive data. The attack can be initiated remotely, but the complexity is rather high and exploitability is reported as difficult.

OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field.

CWE-327 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Johnson Controls TL280 allows cryptanalytic attack.

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public `cs_disasm()` and `cs_disasm_iter()` APIs. For a large but well-formed `br_table` instruction, the WASM decoder accumulates the immediate length in a wider local variable but returns it through a `uint16_t` instruction-size path. When the encoded instruction length is exactly 65,536 bytes, the size wraps to zero and `cs_disasm()` can repeatedly decode the same instruction without advancing. For larger lengths, `cs_disasm_iter()` advances into the middle of the `br_table` payload and decodes target bytes as subsequent instructions. This is an availability and parser-integrity issue. Version 6.0.0-Alpha9 patches the issue.

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at (or redirected/SSRF'd to) a host that returns a non-CKAN response, or when an internal exception occurs, the caller receives verbatim upstream content and internal detail (hostnames, internal IPs, DB errors, stack fragments). This vulnerability is fixed in 0.4.112.