CVE Vulnerability Catalog

A local privilege escalation vulnerability exists in Check Point Identity Agent Full for Windows OS. An authenticated local user may be able to execute arbitrary code with SYSTEM privileges due to improper handling of executable resolution during the log collection process.

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2. Under certain conditions, an authenticated user could have added unauthorized email addresses to a targeted user's account due to improper sanitization of user-supplied input in certain group setting fields.

Golem OEE MES is vulnerable to an unauthenticated path traversal flaw. An attacker in the same local network can read arbitrary files from the server's operating system by manipulating HTTP request paths.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2. Under certain conditions, this could have allowed an unauthenticated user to cause denial of service due to improper input validation in the API request parsing middleware.

GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2. Under certain conditions, an authenticated user with developer-role permissions could execute arbitrary client-side code on behalf of a targeted user due to improper input sanitization in the Analytics Dashboard.

vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory DoS attack due to unbounded frame count processing in the VideoMediaIO.load_base64() method. An attacker can send a single API request with thousands of base64-encoded JPEG frames, causing the server to decode all frames into memory and crash.

Cerebrate before version 1.37 contains a mass-assignment vulnerability in the generic CRUD add path. The add() function does not properly remove the 'id' field from input, allowing a user to set a custom identifier for a new object. This can lead to unauthorized creation of objects with chosen IDs, object spoofing, or identifier collisions.

Cross-site scripting (XSS) vulnerability in the WP Mail Log plugin for WordPress, allowing DOM-Based XSS attacks. Affects versions up to 1.0.2.

Vulnerability in Spring GraphQL causes the @Controller annotation detection mechanism to incorrectly resolve annotations in type hierarchies. This can lead to security annotations being ignored at runtime.

Cross-Site WebSocket Hijacking vulnerability in Spring for GraphQL with WebSocket transport enabled. An attacker can trick an authenticated user into visiting a malicious page, allowing arbitrary GraphQL operations with the victim's credentials.

Spring for GraphQL is vulnerable to unsafe deserialization when processing paginated GraphQL queries. An attacker can craft a malicious request leading to Remote Code Execution (RCE) if the application exposes a Connection field and the classpath contains specific classes.

When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying their safety.

Vulnerability in Spring Web Services (Jaxp13XPathTemplate) causes XPath expressions to be processed with the JDK's default configuration instead of Spring's hardened parser. This can lead to XXE (XML External Entity) attacks when processing untrusted XML data.

Wss4jSecurityInterceptor initialized its BSP compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level checks.

A malicious or compromised FTP/SFTP/SMB server can write arbitrary files outside the configured local directory on the Spring Integration client filesystem. Affected versions: 7.0.0-7.0.4, 6.5.0-6.5.8, 6.4.0-6.4.11, 6.3.0-6.3.14, 5.5.0-5.5.20.

The UpdraftPlus: WP Backup & Migration plugin for WordPress up to version 1.26.4 has an authentication bypass vulnerability in the UpdraftPlus_Remote_Communications_V2::wp_loaded function. Insufficient validation of remote communication messages allows signature verification bypass and predictable encryption keys, enabling unauthenticated attackers to execute arbitrary RPC commands as admin.

Vulnerability in ImageMagick (versions prior to 6.9.13-50 and 7.1.2-25) in the ICON decoder causes an incorrect loop, leading to an out-of-bounds heap write and crash.

Vulnerability in ImageMagick (versions prior to 6.9.13-50 and 7.1.2-25) in the AcquireAlignedMemory function lacks a check for maximum memory request, potentially leading to an out-of-memory condition.

Dulwich versions 0.23.2 through 1.2.5 do not validate submodule paths during recursive clone. An attacker can craft a malicious .gitmodules and gitlink tree with path .git/hooks, causing files to be written into the victim's .git/hooks directory. Executable files are then run on any hook invocation, leading to remote code execution.

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenticated user with Content/DataResource editing privileges to perform template injection attacks that could lead to Remote Code Execution. This issue affects Apache OFBiz before 24.09.07.