CVE Vulnerability Catalog

Plonky3 prior to versions 0.4.3 and 0.5.3 contains a vulnerability where an attacker controlling prover-side observations can craft distinct transcripts that produce identical challenges, breaking the binding property of Fiat-Shamir.

js-cookie before version 3.0.7 has a prototype pollution vulnerability in the `assign()` function. When copying properties from an object from `JSON.parse`, the `__proto__` attribute can be copied, allowing an attacker to set custom cookie attributes such as `domain`, `secure`, or `path`.

ImageMagick prior to versions 7.1.2.23 and 6.9.13-48 lacks a check in the MIFF decoder, allowing a crafted file to cause an infinite loop and CPU exhaustion.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions an out of bounds heap write can occur. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

A vulnerability in the libp2p JavaScript library allows an unauthenticated remote attacker to exhaust disk storage of any @libp2p/kad-dht node running in server mode. The attack sends an unbounded stream of PUT_VALUE messages with keys that bypass content validation.

Sharp, a CMS framework for Laravel, prior to version 9.22.0 exposes a generic download endpoint that authorizes access only to the entity instance but reads the target disk and path from request parameters. An authenticated Sharp user who can view one valid record may use it as an authorization anchor to download unrelated objects from Laravel Storage disks.

TDengine versions 3.4.0.0 through 3.4.1.5 allow an unauthenticated remote attacker to crash the taosd server process by sending a single crafted RPC packet. The issue is fixed in version 3.4.1.6.

Fedify, a TypeScript library for building federated server apps with ActivityPub, is vulnerable to an attack exploiting JSON-LD features. An attacker can restructure a JSON-LD document without changing its Linked Data Signature, allowing modification of a third-party signed activity.

GIMP has a heap-based buffer overflow vulnerability in HDR file parsing, allowing remote code execution. User interaction is required (opening a malicious file or page).

The kafka-python library before version 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling. A malicious broker can supply an excessively large iteration count, freezing the client event loop and preventing message sending, receiving, admin operations, and heartbeats.

A denial-of-service vulnerability in kafka-python before version 2.3.2 allows a malicious broker or man-in-the-middle attacker to exhaust memory or hang connections. The attack sends a crafted 4-byte frame length value without bounds validation.

A command injection vulnerability in Palo Alto Networks PAN-OS software allows an authenticated administrator to bypass system restrictions and run arbitrary commands as root. The user must have access to the PAN-OS CLI or Web UI to exploit this issue.

A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows an authenticated administrator with CLI access to perform actions with root privileges. The risk is minimized when CLI access is restricted to trusted administrators and the management interface is protected.

A privilege escalation vulnerability in the Palo Alto Networks Prisma Access Agent on Linux devices allows a local user to execute code with elevated privileges.

Palo Alto Networks Cortex XSOAR engine software running on Linux has a path traversal vulnerability. An unauthenticated attacker on an adjacent network, capable of intercepting and manipulating network traffic (MITM attack), can write arbitrary files to the host.

A malicious application may cause unexpected changes in memory shared between processes. A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.4.

A flaw in dracut allows a remote attacker on the adjacent network to inject commands via specially crafted DHCP options (e.g., a malicious hostname). These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. The attacker can achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.

The Snappy library in versions prior to 1.7.1 has an issue with improper processing of binary paths, which can lead to code injection. The escapeshellarg function does not work correctly, allowing for the use of unsafe input.

Atril Document Viewer, the default document reader in the MATE desktop environment, contains a single-click remote code execution vulnerability. An attacker can trick a user into clicking a link in a malicious PDF, leading to arbitrary code execution. The issue stems from insufficient argument quoting in the ev_spawn function.

Race condition vulnerability in V8 in Google Chrome prior to version 144.0.7559.99 allows a remote attacker to exploit type confusion via a crafted HTML page.