CVE Vulnerability Catalog

A vulnerability in HKUDS nanobot up to 0.2.1 affects the ExecTool._prepare_command function in nanobot/agent/tools/shell.py of the Login-shell Environment Handler component. Executing a manipulation can lead to information disclosure. The attack requires local access, and the exploit has been published.

pypdf prior to 6.15.0 is vulnerable to excessive memory consumption when parsing crafted PDFs, as the parse_bfrange function in pypdf/_cmap.py handles unusually large tokens in a font /ToUnicode CMap during text extraction. This issue is fixed in version 6.15.0.

A vulnerability in the pypdf library prior to version 6.15.0 allows long runtimes and high memory consumption when extracting text from a crafted PDF. The Font._collect_cid_character_widths function expands unusually large CID font /W width ranges or excessive width entries. The issue is fixed in version 6.15.0.

Hono is a web application framework supporting any JavaScript runtime. From 4.7.0 to 4.12.33, the proxy() function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110, an intermediary must remove these headers before forwarding, but the function only removes standard hop-by-hop headers, potentially leading to disclosure of internal metadata.

Frappe is a full-stack web application framework. Prior to versions 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email.

A vulnerability in SourceCodester Photo Share Website 1.0 affects an unknown part of the file /social/ajax.php?action=save_upload of the Comment Input Box component. Manipulation of the content argument leads to cross site scripting. The attack may be initiated remotely, and the exploit is publicly available.

File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files. When the file to be rotated is a symbolic link to a missing file, and the touch option is enabled, the rotate method assumes that the file is absent and does not rotate it, but touches the file, which creates the target. An attacker who can create the symlink can use this to create an arbitrary file with permissions of the process rotating the files.

Nexus Repository 3 has a Server-Side Request Forgery (SSRF) vulnerability in the email configuration verification feature. A user with nexus:settings:update permission could submit arbitrary host and port values to the email test endpoint, causing the server to attempt outbound connections to internal or restricted addresses. Response differences could be used to infer reachability of internal hosts and ports. Affects up to 3.94.1, fixed in 3.95.0.

Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account with nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed, disclosing internal JVM class metadata such as class and classloader names. This does not allow method invocation, object construction, or arbitrary code execution. Fixed by restricting property access in the JEXL sandbox.

A cross-site scripting vulnerability was found in SourceCodester Photo Share Website 1.0 in an unknown function of the file /social/index.php?page=home. Manipulation of the Comment argument causes XSS. The attack can be initiated remotely and the exploit is public.

A vulnerability was detected in WonderTrader up to 0.9.9 in the function TraderDD::queryTrades of src/TraderDD/TraderDD.cpp. Manipulation of the FID_JYLB argument results in enforcement of behavioral workflow. The attack can be launched remotely but is difficult to exploit. The exploit is public and the vendor did not respond.

A cross-site scripting vulnerability was found in PHPGurukul Company Visitor Management System 1.0 in the file /manage-newvisitors.php. Manipulation of the fullname argument leads to XSS. The attack can be initiated remotely and the exploit is public.

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.

The root password hash of the device can be obtained through unencrypted information in the firmware.

Mermaid before 10.9.8 and 11.16.1 is vulnerable to prototype pollution via configuration setters when untrusted data is passed. Diagram-supplied config is not affected.

Traefik from 3.6.11 to 3.6.25 and 3.7.10 has a vulnerability in BasicAuth middleware allowing an attacker with valid credentials and hash to authenticate as an unconfigured username.

GitHub CLI before 2.97.0 fails to escape regex metacharacters in --signer-repo and --signer-workflow, allowing attackers to bypass Sigstore attestation verification with lookalike names.

GitHub CLI before 2.97.0 masks only part of certain tokens in gh auth status, potentially exposing token fragments in terminal or CI output.

OpenReception before 1.0.6 has a weak proof-of-work (16 bits) in the bootstrap-challenge endpoint, allowing easy bypass of rate limiting and automated abuse of booking flow.

OpenReception before 1.0.6 has a vulnerability in staff deletion by TENANT_ADMIN that removes invites in other tenants sharing the same email.