CVE Vulnerability Catalog

HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted by the application, potentially resulting in unintended behavior or security impact under certain conditions.

In PostgreSQL, the ALTER TABLE ALTER TYPE command incorrectly reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table owner to run DROP STATISTICS and ALTER STATISTICS, while denying those commands to the prior owner. In many ownership arrangements, DROP TABLE still removes statistics objects, so the exploit often achieves nothing.

Integer underflow in PostgreSQL ECPG allows a database server administrator to cause temporary denial of service against the ECPG client by sending a bytea value lacking the mandatory prefix. The client overwrites a large memory region with bytes outside attacker control, typically causing SIGSEGV, but rare cases might achieve client-specific integrity impact.

Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, by setting a hostile search path before calling the amcheck function. Affected versions include 18, 16, 15, and 14 before specific minor versions; PostgreSQL 17 is unaffected.

The Booking for Appointments and Events Calendar WordPress plugin before version 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data.

Version 2.0.0 of the sigstore-java library erroneously removed verification of the integrated (Rekor entry) time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements adhering to the Sigstore verification spec. The vulnerability affects only users verifying bundles with dev.sigstore:sigstore-java:2.0.0.

Loofah from 2.25.0 until 2.25.2 does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references such as &#58, &#9, &#10, or &#13. CGI.unescapeHTML leaves these references encoded, so allowed_uri? reports the URL safe even though a browser decodes an encoded colon or strips encoded whitespace and executes the resulting URI scheme. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.

Loofah from 2.25.0 until 2.25.2 does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character references 	 or 
. CGI.unescapeHTML leaves those references intact, so allowed_uri? reports the URL safe even though a browser decodes and strips the tab or line feed and executes the resulting javascript: URL. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.

Trix prior to 2.1.18 is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without Input Events Level 2 support. The StringPiece.fromJSON method trusts href attributes from the JSON payload without sanitization, allowing a draggable element containing a javascript: URI to bypass DOMPurify sanitization and inject executable JavaScript into the DOM. Exploitation requires the victim to drag and drop attacker-controlled content, and server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.

Astro prior to 8.1.2, the Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remote_images for Netlify's Image CDN allowlist. In packages/integrations/netlify/src/index.ts, remotePatternToRegex() escapes dots in hostname values but interpolates literal pathname values without escaping regular expression metacharacters such as ., +, ?, (, and [, so a restrictive pathname such as /img/v1.0/file also matches metacharacter-adjacent paths, including paths that cross a segment. Netlify enforces the generated regular expression directly and Astro's matchPattern() helper does not revalidate the request, allowing optimization of images on an already-allowed host that the declared pathname was intended to exclude. This issue is fixed in version 8.1.2.

IBM Db2 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to cause a denial of service due to a memory leak.

IBM Security Verify Access and IBM Verify Identity Access (including container versions) in certain Reverse Proxy configurations are vulnerable to a denial of service attack.

GitLab EE has a vulnerability in versions 15.6 through 19.0.6, 19.1 through 19.1.4, and 19.2 through 19.2.2 that under certain conditions could allow a user with pending membership to receive permissions granted by a custom role due to incorrect privilege assignment that did not account for membership state.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to an interpretation conflict in the multipart parser.

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known.

In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route (cmsproxy) is vulnerable to a Server-Side Request Forgery (SSRF) attack via DNS Rebinding. A Time-of-Check to Time-of-Use (TOCTOU) race condition exists between the URL validation phase and the actual HTTP request phase, allowing attackers to access internal network resources and cloud metadata endpoints. Version 0.10.4 fixes the issue.

A Server-Side Request Forgery (SSRF) vulnerability in Fortinet FortiSIEM in multiple versions may allow an attacker to execute unauthorized code or commands.

The Estatik Real Estate Plugin for WordPress before version 4.3.4 does not validate the recipient list used for messages sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body, and Reply-To on sites where the form is configured to route to a custom address.

A rogue Velociraptor client can upload a malformed sparse file that causes a panic when the GUI attempts to expand it, potentially crashing the server process. The issue is a Divide by Zero bug in the ShouldPadFile() function.

In sshd in OpenSSH before 10.5, the 'restrict' keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.