CVE Vulnerability Catalog

XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired.

XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previously used authorization code.

XenForo before version 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint. An unauthenticated attacker can obtain valid token pairs by submitting empty values for client_secret and code_verifier parameters, exploiting PHP truthy evaluation logic that treats empty strings as false and skips client secret and PKCE validation.

An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality. Encrypted connections to target devices were established without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker can impersonate the device during a polling session and intercept communication, including credentials.

An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of entries. Actual credential values are not directly visible, but the user can delete entries or edit their properties.

A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.

Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers should upgrade to the resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.

CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers should upgrade to the resolved maintenance release. Update CommServe and Web Server.

CommServe contained a path traversal issue affecting information disclosure. Software customers should upgrade to the resolved maintenance release. Update CommServe.

CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers should upgrade to the resolved maintenance release. Update CommServe.

CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers should upgrade to the resolved maintenance release. Update CommServe.

CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers should upgrade to the resolved maintenance release. Update CommServe.

Private Metrics Server has a missing authentication condition affecting metrics upload functionality and service availability. Software customers should upgrade to the resolved maintenance release.

DataCube has a path traversal issue affecting security feature enforcement. Software customers should upgrade Content Extractor and Index Store.

fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. This can expose the debugging interface beyond the local machine, and because the Inspector protocol allows arbitrary code evaluation, a remote party can achieve remote code execution on the developer's machine. Affects fastify-cli from 1.5.0 up to 8.0.1. Users should upgrade to fastify-cli 8.0.1, which honors the configured Inspector bind address.

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RST_STREAM frames and GOAWAY frames sent by the client. The race condition "resets" the HTTP2Flusher.terminated, previously set to a non-null value, to the null value, allowing entries to be enqueued in the flusher that however will never be processed. These unprocessed entries are the ones that would unblock the write-blocked threads.

Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized.

PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load_mon module's stop path where exit_and_cleanup() deletes the LoadMon object and frees the performance counter before perf_end() attempts to access it. Attackers can trigger this vulnerability by issuing the load_mon stop command from any PXH or MAVLink shell, causing reads and writes through freed memory that corrupt heap objects and destabilize the flight stack.

SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected scripts execute with full Node.js access through the Electron main process.