CVE Vulnerability Catalog

PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes.

PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from clients. Attackers can send crafted inventory transactions with malformed NBT tags to trigger server crashes and cause denial of service.

PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by newline characters, allowing attackers to send large messages containing many newlines. Malicious clients can send megabyte-sized chat packets and bombard the server with thousands of such messages, causing server lockups lasting seconds or minutes.

PocketMine-MP before version 4.4.2 fails to properly validate item IDs received from clients in itemstack NBT data. Attackers can send crafted item IDs outside the valid range to trigger an uncaught exception that crashes the server.

Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and note data, and arbitrary invocation of native device APIs.

The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'content_process_images' function using a flawed regex-based HTML attribute parser. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

In MISP up to version 2.5.45, the validation of the user-configurable homepage only checks if the path starts with '/', which is insufficient. Protocol-relative URLs like '//attacker.example' also start with '/' but resolve to an external origin in browsers. The vulnerable homepage value can be stored and used in post-login routing.

In SourceCodester Simple Traffic Offense System 1.0, a vulnerability was found in the file save-settings.php of the Settings Update Endpoint component. Manipulation of the site_name/site_desc arguments leads to cross-site scripting. Remote exploitation is possible, and the exploit has been disclosed.

Zohocorp ManageEngine Endpoint Central versions below 11.5.2600.15 are vulnerable to privilege escalation due to an outdated component.

In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received through the Control Interface FIFO. A workload with Control Interface access can specify an excessive message length, causing unbounded memory allocation that may abort the agent process, resulting in loss of orchestration services.

A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver versions 2.5.0 through 2.8.6 allows local authenticated users to cause a system crash via crafted control messages.

Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to local privilege escalation due to loading a DLL from an untrusted path.

Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to privilege escalation during JAR extraction.

In MISP versions up to 2.5.45, any authenticated user can access TemplatesController::uploadFile() because the ACL entry for templates/uploadFile used the wildcard *. This bypass allows low-privileged or read-only users to repeatedly upload files and consume server disk space. The fix changes the ACL requirement from * to perm_add.

In SourceCodester Simple Traffic Offense System 1.0, a vulnerability was found in the file delete-user.php of the Deletion Endpoint component. Manipulation of the ID argument leads to missing authentication. The attack can be launched remotely, and the exploit has been published.

In itsourcecode Sales and Inventory System 1.0, a vulnerability was detected in the file /pages/us_edit1.php. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed publicly.

Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01 are vulnerable to local privilege escalation due to Agent upgrade.

Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview performed correlation lookups against attributes from events without applying the requesting user's ACL, allowing restricted event correlations and associated event information to be exposed to users who could not otherwise access those events. The same preview functionality also returned cross-feed correlation information without properly restricting the feed list to feeds visible to the caller, exposing metadata for feeds not marked lookup_visible, and one affected response included the configured feed URL.

A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard user can retrieve the cluster NVIDIA NGC API key Secret (apiKeySecret) and the NIM image pull secret (nimPullSecret). This is missing authorization (CWE-862) and insufficiently protected credentials (CWE-522).

A vulnerability was found in Ollama up to 0.31.1. This issue affects the function readGGUFV1String of the file fs/ggml/gguf.go of the component GGUF Decoder. Performing a manipulation results in integer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 0.31.2-rc1 is capable of addressing this issue.