CVE Vulnerability Catalog

A vulnerability was detected in marcobambini Gravity up to 0.9.7. This impacts the function parse_number_expression of the file src/compiler/gravity_parser.c of the component Number Parser. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 0.9.8 will fix this issue. The patch is named 1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6. It is recommended to upgrade the affected component.

A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the file src/utils/gravity_json.c of the component JSON parser. This manipulation causes memory corruption. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.8 is sufficient to resolve this issue. Patch name: 9b337c3eae5833c3956bed1fc01c21c14fd443f2. It is suggested to upgrade the affected component.

A cross-site scripting (XSS) vulnerability was found in Apache Syncope due to improper input neutralization during web page generation. The notification message shown on Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline via malicious HTTP link generation. Affects versions from 4.0.4 through 4.0.7 and from 4.1.0-M0 through 4.1.2.

In Apache Syncope, an administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression that allows any administrator with sufficient User read entitlements to access sensitive information of LinkedAccount or Manager, possibly including hashed credentials. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

In Apache Syncope, audit events sent to the configured store are not sufficiently masked for the sensitive values they might carry, allowing administrators to access such sensitive values. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

A vulnerability was identified in Gitlawb openclaude up to 0.30.0. Impacted is the function waitForCallback of the file src/services/api/xaiOAuthCallback.ts of the component xAI OAuth Callback Handler. The manipulation of the argument Error leads to denial of service. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the component Admin Console. Such manipulation of the argument text leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

In the Joomla extension - SP Page Builder Pro (versions 3.2.6 - 5.6.1p2 and 6.0.0 - 6.9.0) in the Contact, Opt-in and Form Builder addons, there is an unauthenticated CAPTCHA bypass in module context. In the ajax_contact, optin_form and form_builder addons, the result returned by the CAPTCHA plugin's onCheckAnswer event was discarded and replaced with a test for a non-empty string whenever the request-supplied view_type parameter equaled 'module'. Submitting view_type=module together with any arbitrary token value therefore passed verification. This affected every instance of these addons placed inside an SP Page Builder module, irrespective of the CAPTCHA type configured for the site, and the view_type parameter was never validated against the context in which the form was actually rendered.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate that a property field belongs to the specified run before updating its value. An authenticated user with run property-management access can crash the Playbooks plugin via a REST request referencing a property field that belongs to a different run.

The ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Improper Access Control vulnerability. An authenticated local attacker can send a specially crafted IOCTL request to cause the driver to write to improperly restricted I/O ports, resulting in a forced operating system reboot.

The ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Untrusted Pointer Dereference vulnerability. An authenticated local attacker can send a specially crafted IOCTL request to cause the driver to dereference an unvalidated pointer, resulting in an operating system crash.

A vulnerability was identified in D-Link DWR-M921 1.1.52. It affects the formWsc function of the file /boafrm/formWsc. Manipulation of the targetAPSsid argument leads to OS command injection. The attack can be carried out remotely, and the exploit is publicly available and may be used.

A vulnerability was determined in D-Link DWR-M921 1.1.52. It affects the formsysCmd function of the file /boafrm/formsysCmd of the Boa Dispatch Table component. Manipulation of the sysCmd argument can lead to OS command injection. The attack can be executed remotely, and the exploit has been publicly disclosed and may be utilized.

The Joomla extension SP Page Builder (Free and Pro) versions 4.0.0–6.9.0 contains a Missing Access Control vulnerability in menu item creation. The add-to-menu routine invoked the com_menus item model's save() method directly; that model does not perform authorisation itself, because the relevant checks reside in the com_menus controller, and the only check applied was core.edit on com_sppagebuilder. Users with no permissions whatsoever on com_menus could therefore create menu items, and because the record identifier was taken from the submitted jform[menuid] field, could also overwrite existing ones. The home flag was read back from the database and preserved, so the site's home menu item could be repointed while remaining the home item.

In the SP Page Builder extension (versions 4.0.0 - 6.9.0), the folder request parameter replaced the generated date-based destination folder entirely and was passed to Folder::create() and File::upload() without directory boundary checks. This allowed files to be written into any directory beneath the web root, including administrator/, templates/, cli/ and the site root. Joomla's PATH input filter prevented traversal above the web root, and existing files were not overwritten.

In the SP Page Builder Pro extension (versions 5.1.4 - 6.9.0), the optin_form addon read the CAPTCHA type, expected answer, and enabled flag from the request rather than from the stored addon configuration. Verification reduced to md5($captcha_question) != $captcha_answer with both operands supplied by the attacker, allowing unauthenticated CAPTCHA bypass.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the size of unpacked SDP messages compressed with zlib. An attacker can send many SDP messages that unpack to a large size, causing denial of service or server crash.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files. An authenticated user can cause excessive server memory consumption and potential denial of service by uploading a specially crafted image as a profile picture, channel file attachment, team icon, or custom brand image.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce the board-creation permission. An unauthorized authenticated user can create boards via the board duplicate, boards-and-blocks, and archive-import endpoints.