CVE Vulnerability Catalog

Vulnerability in ImageMagick (versions prior to 6.9.13-48 and 7.1.2-24) in the DCM decoder lacks validation of image dimensions, potentially causing crashes during subsequent operations.

Apache OFBiz before version 24.09.07 contains a privilege escalation vulnerability that allows a low-privileged authenticated user to obtain higher privileges.

Pi-hole FTL before version 6.6.1 contains a race condition vulnerability in the HTTP session management subsystem, introduced with the v6.0 rewrite of the embedded CivetWeb-based web server. This issue has been patched in version 6.6.1.

A vulnerability in the Dulwich library (versions 0.24.0 through 1.2.4) allows arbitrary command execution. An attacker can craft a malicious file path in a Git branch, which is substituted into the merge driver command via the %P placeholder and executed with shell=True when a victim merges the branch.

Xibo CMS prior to version 4.4.2 contains a vulnerability chain of Stored XSS and Iframe Sandbox escape. Users with DataSet permissions can use the Data Connector to craft messages that escape the sandbox and enable XSS.

A vulnerability in the Dulwich library (versions 0.10.0 through 1.2.4) allows remote code execution via arbitrary file write when cloning or checking out a malicious Git repository on Windows. The issue stems from improper validation of path elements that can contain bytes interpreted by Windows as structural path syntax. Additionally, the core.protectNTFS and core.protectHFS security settings were silently ignored due to configuration bugs.

Vulnerability in Copy & Delete Posts through 1.5.4 lets any plugin-enabled non-admin role invoke all operations in the cdp_action_handling AJAX handler. Attackers with an enabled role can delete posts or overwrite plugin settings via the f parameter, bypassing per-function capability checks.

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the IPv4 validation logic present starting in version 0.11.2 and prior to versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 appears incomplete. The `validatePublicUrl()` protection relies on `isValidPublicIPv4Address()` to reject non-public IPv4 destinations. The function blocks common private and local ranges such as `10.0.0.0/8`, `127.0.0.0/8`, `169.254.0.0/16`, `172.16.0.0/12`, and `192.168.0.0/16`, but it still treats several special-use, reserved, multicast, benchmarking, and carrier-grade NAT IPv4 ranges as valid public destinations. Because this validation is used as an SSRF defense before outbound fetches, this appears to be an incomplete mitigation or bypass class for the previous SSRF issue. Versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 contain an updated patch.

Vulnerability in the Russh library (Rust SSH client & server) from version 0.34.0 to before 0.61.0. A remote SSH peer can send oversized or malformed length-prefixed fields, causing memory allocation or attempted allocation before rejecting data, potentially leading to denial of service or other issues.

The Russh Rust SSH library versions 0.34.0 through 0.61.1 have a vulnerability related to SSH compression. When compression is enabled, a remote peer can send a compressed packet that decompresses to a much larger size than allowed, leading to resource exhaustion.

Kanidm before version 1.9.3 is vulnerable to a DoS attack via stack overflow in the PEG parser. An unauthenticated GET request with a filter containing thousands of nested parentheses causes the kanidmd process to abort. The vulnerability is patched in version 1.9.3.

libp2p (JavaScript Implementation) prior to version 15.0.23 has a vulnerability in @libp2p/gossipsub that allows a single unauthenticated peer to exhaust the Node.js heap of a gossipsub node with default options.

A vulnerability in the Russh library (Rust SSH client & server) before version 0.60.3 in the CryptoVec class allows unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths. Local SSH agents can feed attacker-controlled frame lengths before validation, and in older versions (before 0.58.0) remote SSH traffic also reached CryptoVec through transport and compression buffers.

OpenVM prior to version 1.6.0 contains a vulnerability in the openvm-pairing guest library where the try_honest_pairing_check function does not check that the scaling factor s is in a proper subfield of Fp12. This allows incorrect results to the pairing check.

Plonky3 prior to versions 0.4.3 and 0.5.3 contains a vulnerability where an attacker controlling prover-side observations can craft distinct transcripts that produce identical challenges, breaking the binding property of Fiat-Shamir.

js-cookie before version 3.0.7 has a prototype pollution vulnerability in the `assign()` function. When copying properties from an object from `JSON.parse`, the `__proto__` attribute can be copied, allowing an attacker to set custom cookie attributes such as `domain`, `secure`, or `path`.

ImageMagick prior to versions 7.1.2.23 and 6.9.13-48 lacks a check in the MIFF decoder, allowing a crafted file to cause an infinite loop and CPU exhaustion.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions an out of bounds heap write can occur. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

A vulnerability in the libp2p JavaScript library allows an unauthenticated remote attacker to exhaust disk storage of any @libp2p/kad-dht node running in server mode. The attack sends an unbounded stream of PUT_VALUE messages with keys that bypass content validation.

Sharp, a CMS framework for Laravel, prior to version 9.22.0 exposes a generic download endpoint that authorizes access only to the entity instance but reads the target disk and path from request parameters. An authenticated Sharp user who can view one valid record may use it as an authorization anchor to download unrelated objects from Laravel Storage disks.