CVE Vulnerability Catalog

NVIDIA Megatron Bridge contains a vulnerability that allows deserialization of untrusted data. Successful exploitation could lead to code execution, data tampering, and information disclosure.

NVIDIA Megatron Bridge contains a vulnerability that allows deserialization of untrusted data. Successful exploitation could lead to code execution, data tampering, and information disclosure.

NVIDIA Megatron Bridge contains a vulnerability that allows deserialization of untrusted data. Successful exploitation could lead to code execution, data tampering, and information disclosure.

NVIDIA Megatron Bridge contains a vulnerability that allows deserialization of untrusted data. Successful exploitation could lead to code execution, data tampering, and information disclosure.

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges.

Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to modify privileged QoS policy on the master device via sending a crafted MQTT message to the cs_broker component.

A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-' characters but the internal BCP 47 scanner aliases '_' to '-' after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using '_' separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users.

The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec() function, combined with missing authorization checks on the REST API endpoints. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary commands on the underlying server.

A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.

A vulnerability in Cleo Harmony up to version 5.8.1.10 affects an unknown function in the /api/connections file of the JWT Refresh Token Handler component. Manipulation of the Bearer argument leads to improper privilege management. The attack can be carried out remotely, and the exploit has been made public.

A vulnerability in Chanjet CRM up to version 20260707 affects the file jxf_dump_table.php. Manipulation of the gblOrgID argument causes SQL injection. The attack can be performed remotely, and the exploit has been published. The vendor did not respond to the disclosure.

xmldom is a JavaScript module implementing DOMParser and XMLSerializer. In versions from 0.7.0 to 0.8.15, the parser in lib/sax.js uses an unanchored global expression to trim end-tag names, leading to quadratic backtracking on long whitespace runs. A small unauthenticated XML document can stall the Node.js event loop. This issue is fixed in version 0.8.15.

xmldom is a JavaScript module implementing DOMParser and XMLSerializer. In versions from 0.9.10 to 0.9.12, validation of DocumentType.publicId and systemId using expressions with the multiline flag allows bypassing validation and injecting markup into the <!DOCTYPE> declaration. This issue is fixed in version 0.9.12.

xmldom is a JavaScript module implementing DOMParser and XMLSerializer. In versions from 0.9.11 to 0.9.12, element and attribute name checks using the QName_exact expression with the multiline flag allow bypassing validation and injecting markup into element or attribute names. This issue is fixed in version 0.9.12.

xmldom is a JavaScript module implementing DOMParser and XMLSerializer. Prior to versions 0.8.15 and 0.9.12, and in xmldom 0.6.0 and earlier, Document.createProcessingInstruction() accepts an unvalidated target, allowing XML structure injection by breaking the processing-instruction boundary. This issue is fixed in versions 0.8.15 and 0.9.12; no fix is available for xmldom.

xmldom is a JavaScript module implementing DOMParser and XMLSerializer. Prior to versions 0.8.15 and 0.9.12, and in xmldom 0.1.5-0.6.0, appendElement in lib/sax.js clones the entire namespace map for each nested element, leading to quadratic memory usage. A small XML document can exhaust the process heap. This issue is fixed in versions 0.8.15 and 0.9.12; no fix is available for xmldom.

xmldom is a JavaScript module implementing DOMParser and XMLSerializer. Prior to versions 0.8.15 and 0.9.12, and in xmldom 0.3.0-0.6.0, two independent quadratic paths can cause denial of service: parseElementStartPart repeatedly rescans a malformed tag name, and normalize() repeatedly removes and appends adjacent text nodes. This issue is fixed in versions 0.8.15 and 0.9.12; no fix is available for xmldom.

xmldom is a JavaScript module implementing DOMParser and XMLSerializer. Prior to versions 0.8.15 and 0.9.12, and in xmldom 0.6.0 and earlier, DOMHandler.startElement inserts every attribute through setAttributeNode, and NamedNodeMap.setNamedItem performs a linear lookup, leading to quadratic complexity with many attributes. A small XML document can stall the Node.js event loop. This issue is fixed in versions 0.8.15 and 0.9.12; no fix is available for xmldom.

xmldom is a JavaScript module implementing DOMParser and XMLSerializer. In versions from 0.9.0-beta.1 to 0.9.12, HTML-mode parsing through DOMParser.parseFromString() mishandles mixed-case closing tags for script, style, textarea, and title elements. This leads to unstable parser progression and quadratic output amplification. A small text/html document can consume disproportionate CPU and memory. This issue is fixed in version 0.9.12.

In xmldom versions 0.9.0 through 0.9.11, the QName_exact validator uses the multiline flag, accepting malformed XML names containing line terminators. This can lead to markup injection during serialization.