CVE Vulnerability Catalog

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.8 are vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to execute unauthorized actions on behalf of a trusted user.

In the Zephyr system, the print_coredump_hdr() function uses the 16-bit tgt_code field from a coredump header as an index into a fixed 7-element array without bounds checking. A tgt_code >= 7 causes an out-of-bounds read, potentially disclosing device memory or causing a crash.

fuse-overlayfs before version 1.17 preserves SUID and SGID mode bits in main.c during open(O_TRUNC) and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with mode 4777.

The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service. This issue affects Apache Traffic Server from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information.

An improper access control vulnerability in Koollab LMS allowed an unauthenticated attacker to read another user's name, internal identifier, scores, lesson status, lesson position, and cached lesson state via the SCORM API endpoint.

An unauthenticated attacker can forcibly terminate the session of any Koollab LMS user by knowing their email address via the login kickout endpoint, leading to denial of service.

An authenticated attacker can upload malicious content disguised as an image file via the feedback mail registration endpoint in Koollab LMS due to unrestricted image upload.

In datamodel-code-generator prior to version 0.63.0, the get_body function reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, potentially leaking credentials to external servers. This issue has been fixed in version 0.63.0.

The sqlite3 Ruby bindings for SQLite3 from version 2.1.0 to 2.9.4 contain a use-after-free vulnerability in callbacks used for SQLite aggregate functions. Callbacks can be freed while still referenced during aggregation, leading to memory corruption.

The sqlite3 Ruby bindings for SQLite3 in version 2.9.4 and earlier contain a use-after-free vulnerability when redefining a SQLite function with a different arity. The previously registered function handler is freed while SQLite may still reference it, leading to memory corruption.

The tiny-http library up to version 0.12.0 has an HTTP header injection vulnerability, allowing attackers to inject CR and LF bytes into header values. Insufficient validation leads to response splitting, cache poisoning, session fixation, and request smuggling.

The `Element.findall()` and `Element.iterfind()` methods in the XML parser have O(n^2) time complexity when using XPath index predicates on documents with many siblings. `Element.find()` is only affected when searching for last matches.

The quick setup view shown to users after creating an event does not properly check user permissions to change configuration for that event. An attacker can use a well-timed request to create products, quotas, set bank transfer configuration, or connect a Stripe account to an event they do not have access to.

In GStreamer's gst-plugins-good, a heap-based out-of-bounds read of 4 bytes occurs when parsing FLAC audio stream headers embedded in Matroska or WebM container files. A boundary check does not account for the full size of the copied data, allowing a small read past the end of the allocated buffer. An attacker can exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it.

Successful exploitation of this vulnerability allows an attacker with local network access to bypass the application's rate-limiting mechanism, enabling brute-forcing of the screen-sharing code and potentially displaying harmful content on the affected screen.

The Quiz and Survey Master (QSM) WordPress plugin before version 11.1.5 does not perform a capability check before deleting output templates. This allows users with contributor-level access and above to delete arbitrary templates.

The Event Tickets and Registration WordPress plugin before version 5.28.4 does not properly escape event titles before outputting them in a ticket history log. This allows users with the Editor role and above to perform Stored Cross-Site Scripting (XSS) attacks that execute against higher-privileged users on multisite installations.

A lock screen issue in macOS fixed with additional restrictions. A person with physical access to a locked device may access contacts and photos.

In Astro versions 8.1.0 through 11.0.1, when trailingSlash: 'always' is configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\ (slash-backslash) were not recognized as internal paths, so the handler would echo the raw path back in the Location header. Because browsers treat \ as / per the WHATWG URL specification, the resulting redirect could resolve to an external host.