CVE Vulnerability Catalog

A vulnerability in the DirectIo64.sys kernel driver of PassMark products before specified versions is due to improper access control, as the device object is created without a security descriptor. Unprivileged local users can open a handle to the device and issue IOCTLs through the permissive default Windows ACL, gaining access to restricted hardware operations regardless of privilege or integrity level.

An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file.

File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file.

A vulnerability in Nango before 0.71.6 is due to missing authentication in the runner tRPC server, allowing unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process.

An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.3-9 might allow a local user to execute arbitrary commands with root privileges via a Java process whose executable path contains embedded newline characters.

Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute names in a data model file.

A SQL injection vulnerability in ILIAS before versions 9.22, 10.10, and 11.3 exists in the repository trash table where the table navigation sort field from HTTP requests is passed directly into the ORDER BY clause of a SQL query without validation against declared sortable columns. Authenticated users with write permission on any container can inject arbitrary SQL through the sort parameter, and because multi-statement execution is enabled in the database layer, stacked queries enable full database read and write access as well as administrator account takeover.

SolidInvoice prior to version 3.0.1 contains a deserialization vulnerability in the DataGrid LiveComponent, where a writable context prop is deserialized with PHP's unserialize(). An authenticated attacker can supply an arbitrary PHP serialized payload, potentially leading to code execution.

PJSIP prior to commit acc03b5 has a stack buffer overflow in PJSUA when processing Service-Route headers in a registration response. An excessive number of headers can cause a write past the end of a fixed-size array on the stack.

PJSIP prior to commit 673b978 has a remote out-of-bounds read and write in the SDP negotiator when the remote payload-type map maintenance feature is enabled. Insufficient bounds validation can cause memory access outside fixed-size tables.

Frappe CRM prior to version 1.73.0 has an authentication bypass vulnerability via logged invitation keys in crm/api. An attacker can exploit these keys to gain unauthorized access.

Emlog versions 2.6.29 and prior process article content with Parsedown without enabling safe mode, allowing raw HTML including <script> tags to pass through unescaped. This results in stored XSS visible to all site visitors.

Note Mark prior to version 0.19.5 improperly validates slug values because the OpenAPI/huma pattern is not anchored, allowing paths with ../ segments to be accepted. Data export commands use these slugs to create files outside the export directory, potentially leading to file writes with root privileges.

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A null dereference causes an uncaught TypeError that terminates the process.

Parrot AR.Drone versions 1 and 2 lack a suitable mechanism to prevent denial-of-service (DoS) attacks. An attacker can harm device availability (e.g., video streaming and control) by using tools to perform IPv4 flood attacks, including SYN flooding and UDP flooding.

The Parrot AR.Drone 1 and AR.Drone 2 platform is vulnerable to Wi-Fi deauthentication attack, allowing remote and unauthenticated attackers to disconnect the drone from the controller during mid-flight.

undici 8.10.0 omits the destination origin from cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. This allows cross-origin information disclosure and persistent cache poisoning. Affects versions 8.10.0 to 8.10.2; applications using an Agent are not affected.

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application's custom checkServerIdentity was written to reject, but which still passes Node's default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool.

IBM ContextForge MCP Gateway - Translate utility <= 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session.

IBM ContextForge MCP Gateway <= v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters.