CVE Vulnerability Catalog

An issue was discovered in the content_consent (aka Content Consent) extension through 2.0.1 for TYPO3. It fails to verify whether a specified content element identifier is permitted by the plugin. This enables an unauthenticated user to display various content elements, leading to an insecure direct object reference (IDOR) issue with the potential to expose internal content elements.

An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. The backend module allows an authenticated backend user to perform various actions (userLogout, confirmUser, refuseUser, and resendUserConfirmation) for any frontend user in the system.

The femanager extension 7.x before 7.2.3 for TYPO3 fails to check access permissions for the edit user component. An authenticated frontend user can exploit this to either edit data of various frontend users or delete various frontend user accounts.

A vulnerability in GPAC up to f1219cde affects the function gf_node_changed_internal of the file scenegraph/base_scenegraph.c of the MP4Box component. The manipulation causes use after free. The attack can be initiated remotely, and the exploit has been publicly disclosed.

A vulnerability in GPAC up to f1219cde affects the function gf_bt_report of the file scene_manager/loader_bt.c of the MP4Box component. The manipulation results in memory corruption. The attack may be performed remotely, and the exploit has been made public.

Buffer overflow vulnerability in Panasonic Industry USB Driver for MINAS A5/A6 allows attackers to stop Windows.

The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents. This can lead to an XML Entity Expansion attack.

The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation component.

A directory traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a crafted request to the StaticResourceController.java component.

A security vulnerability was detected in Matthias-Wandel jhead up to 3.3. It affects the ProcessGpsInfo function in gpsinfo.c of the WebP EXIF Handler component. Manipulation of the TAG_GPS_LAT/TAG_GPS_LONG arguments leads to a heap-based buffer overflow. The attack requires local access and the exploit has been publicly disclosed.

HotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/restore function. This may allow uploading dangerous files.

An issue was discovered in Softing OPC UA C++ SDK through 6.20 and Softing Secure Integration Server through 1.22. By using FileType renames, it is possible to bypass limitations on assignment of a directory path to FileDirectory OPC UA objects and a file path to File OPC UA objects.

A vulnerability was identified in ipa-lab HackingBuddyGPT up to 0.5.0. It affects the ssh_run_command function in src/hackingBuddyGPT/extensions/ssh_run_command.py and leads to OS command injection. The attack can be launched remotely and the exploit is publicly available.

A security vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. It affects an unknown part of /subject1.php, and manipulation of the subject argument leads to cross site scripting. The attack can be executed remotely and the exploit has been publicly disclosed.

A weakness was identified in FedML-AI FedML up to 0.9.6. It affects the S3Storage.read_model function in fedml/core/distributed/communication/s3/remote_storage.py of the MQTT+S3 Communication Backend component, and manipulation of the s3_key_str argument causes deserialization. Remote exploitation is possible and the project has not responded to the report.

An untrusted pointer dereference vulnerability was discovered in the camera component of Samsung Exynos 1580 and 2500 processors. Sending a malformed message to the camera driver causes limited information disclosure or denial of service.

A vulnerability was found in the CustOS driver of Samsung Exynos 1580. Requesting oversized shared memory from the custos_iwc device enables out-of-bounds read and write, potentially leading to memory corruption or information leakage.

Incorrect handling of unauthenticated downlink RRC Setup messages was found in the NR RRC component of Samsung Exynos processors and modems (including 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, W1000, Modem 5300, 5400, 5410). This can cause the baseband to crash.

An out-of-bounds write exists in the DPU driver of Samsung Exynos processors (1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, 2600) due to missing input length validation in color mode LUT parsing. This leads to kernel memory corruption and potential privilege escalation.

A double-free vulnerability exists in the Samsung Exynos DPU driver (1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, 2600) due to improper pointer management during DMA buffer reallocation. This leads to kernel memory corruption and a potential use-after-free.