CVE Vulnerability Catalog

In GNU Binutils 2.47, a vulnerability was detected in the function elf_x86_64_relocate_section in the file bfd/elf64-x86-64.c, in the ld component. Manipulation of the argument roff leads to a buffer overflow. The attack requires local access. A fix is available in version 2.48.

In GNU Binutils 2.47, a weakness was identified in the function bfd_putl64 in the file bfd/libbfd.c, in the ld component. This manipulation causes a null pointer dereference. The attack requires local access.

In GNU Binutils 2.47, a security flaw was discovered in the function cache_bwrite in the file bfd/cache.c, in the ld component. Manipulation of the argument nbytes results in a buffer overflow. The attack requires local access.

A SQL injection vulnerability was identified in itsourcecode Leave Management System 1.0 in an unknown function of the file /module/company/index.php. Manipulation of the ID argument allows remote attack. The exploit is publicly available and might be used.

In webtransport-go prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A malicious peer can send a large unknown capsule and cause a client or server to allocate memory for the full payload, as QUIC flow control does not bound the total retained allocation. This results in memory and resource exhaustion that can disrupt or crash the affected process.

In dbt-mcp prior to 1.20.0, the local OAuth helper in src/dbt_mcp/oauth/fastapi_app.py exposes GET /dbt_platform_context without authentication or Host validation after a user completes the dbt Platform OAuth flow. The endpoint returns the full DbtPlatformContext, including access_token and refresh_token values, to any process that can reach 127.0.0.1:6785. The absence of TrustedHostMiddleware allows a remote attacker to use DNS rebinding against a victim's browser, while a co-located process can request the endpoint directly. The stolen tokens provide immediate dbt Platform API access as the victim and persistent access through the refresh token, allowing access to or modification of projects, jobs, environment secrets, and related account data.

hashi-vault-js prior to 0.5.2 passes failed requests through parseAxiosError(), which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These objects can contain the X-Vault-Token request header and err.config.data request body, including submitted passwords or secret values. When a consuming application records the caught exception through logging or monitoring, the live Vault token and request secrets can be stored in plaintext.

In WeasyPrint prior to 70.0, server-side applications that configure a restrictive url_fetcher and pass attacker-influenced values to HTML.write_pdf() can have the restriction bypassed through the xmp_metadata or stylesheets options. In weasyprint/pdf/init.py, xmp_metadata calls select_source() without the document url_fetcher, allowing an accessible local file to be read and embedded verbatim in the output PDF. In weasyprint/document.py, stylesheets constructs CSS() without the document url_fetcher, allowing local or internal resource loading and propagating the permissive fetcher through nested CSS imports and url() references. The stylesheets channel applies fetched resources but does not by itself disclose stylesheet comments verbatim.

In the safeurl library prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an application enables IPv6 via EnableIPv6(true), an attacker-controlled destination in one of these ranges is not recognized as non-public and can pass the SSRF destination check. IPv6 is disabled by default, so configurations with EnableIPv6(false) are not exposed.

ExifReader before version 4.40.1 has a vulnerability in the ISO-BMFF parser where findMetaBox() and parseBox() do not confirm that required fields remain in the DataView. Specially crafted HEIC or AVIF data can lead to an unchecked full-box version read or reading absent size fields, causing a RangeError that can abort an application request or worker.

The Zephyr SDIO subsystem has a vulnerability in sdio_io_rw_extended_helper() where func->cis.max_blk_size is decoded from the SDIO card without validation. If a card reports a maximum block size of zero, the transfer loop never terminates, causing a thread hang and permanent mutex lock, leading to denial of service for the SDIO peripheral.

A flaw was found in sssd where a local unprivileged user can send a specially crafted request with a zero-length body to the NSS responder. This can lead to instability or termination of the NSS responder, causing denial of service.

A flaw was found in SSSD where a local attacker with privileges to connect to the PAM responder socket can send a specially crafted protocol request. If `pam_app_services` is enabled and the service item is omitted, a NULL pointer dereference can occur, crashing the PAM responder and disrupting authentication services.

A flaw was found in sssd in the PAM responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body, triggering an out-of-bounds read that may cause the PAM responder to terminate or restart, leading to a local denial of service.

A vulnerability was found in itsourcecode Loan Management System 1.0 in the file navbar.php, where manipulation of the argument page can lead to cross site scripting (XSS). The attack can be launched remotely, and the exploit has been publicly disclosed.

A vulnerability was found in GPAC up to f1219cde in the function gf_sg_script_load of the file scenegraph/vrml_tools.c of the MP4Box component. Manipulation leads to use after free. The attack can be initiated remotely, and the exploit has been made public. Upgrading to version abi-16.23 fixes the issue.

A vulnerability was found in GPAC up to f1219cde in the function gf_node_get_name of the file scenegraph/base_scenegraph.c of the MP4Box component. Manipulation leads to use after free. The attack may be performed remotely, and the exploit has been disclosed. Upgrading to version abi-16.23 is recommended.

A flaw has been found in GPAC up to f1219cde in the function gf_node_list_get_child of the file scenegraph/base_scenegraph.c of the MP4Box component. Manipulation of the argument Target causes null pointer dereference. The attack can be carried out remotely, and the exploit has been published. Upgrading to version abi-16.23 addresses the issue.

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This may lead to a denial of service by crashing the NSS responder process.

In Siglet current and past versions, the refresh token handler does not enforce proof of possession of the issuer DID.