CVE Vulnerability Catalog

A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the untrusted on-disk di_depth field without bounds validation. A crafted GFS2 filesystem image with a large di_depth value causes stack exhaustion and a denial of service when processed by fsck.gfs2, gfs2_edit, or savemeta.

Dell PowerProtect Data Manager versions 20.2.0.0 and below contain a Reliance on Data/Memory Layout vulnerability. An unauthenticated remote attacker could exploit it to launch phishing attacks.

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `skype_url` shortcode attribute of the Social Media Follow module in all versions up to, and including, 4.27.6. This is due to a three-part sanitization failure: the field is not whitelisted, rendering skips esc_url(), and only sanitize_text_field() is applied, allowing attribute breakout. Authenticated attackers with Contributor-level access and above can inject scripts.

The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker to predict future secrets. This enables malicious actors to forge event payloads with valid HMAC signatures, bypassing the API Gateway's authenticity verification.

The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postBodyCss' parameter in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access and above can inject scripts.

RTU500 has a vulnerability where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry of the enhanced message queue. This can cause a BCI_IEC104 fatal write error, resulting in connection interruption and restart, and ultimately a denial of service for bidirectional IEC 60870-5-104 communication.

OptimiDoc Server (On-Premise) stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, including SMTP, FTP (for scan delivery), Active Directory (for user list import), and SharePoint credentials, in cleartext via the web administration panel page source, allowing exposure of sensitive third-party authentication data. This issue was fixed in version 26.08.

Error in handling the PlatformLangCodes UEFI variable could cause a buffer overflow, leading to resource exhaustion and failure.

An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege.

Vulnerability in RightNow-AI OpenFang up to 0.6.9, affecting the shell_exec function in crates/openfang-runtime/src/tool_runner.rs, leading to uncontrolled memory allocation. The attack can be performed remotely, and the exploit is publicly available.

Vulnerability in simular-ai Agent-S up to 0.3.2, affecting unknown functionality in grounding.py of the Model-generated GUI Action Execution Workflow component, leading to denial of service. The attack can be launched remotely, and the exploit is publicly available.

Vulnerability in simular-ai Agent-S up to 0.3.2, affecting the ImageData function in gui_agents/s1/utils/ocr_server.py of the OCR HTTP API component. Manipulating the img_bytes argument leads to resource consumption. The attack can be launched remotely, and the exploit is publicly disclosed.

Vulnerability in simular-ai Agent-S versions 0.3.1 and 0.3.2, affecting an unknown function in code_agent.py of the CodeAgent component, leading to denial of service. The attack can be launched remotely, and the exploit is publicly disclosed.

A vulnerability was found in sigoden aichat up to version 0.30.4, involving uncontrolled memory allocation in an unknown function of the file src/serve.rs in the API Endpoint component. The attack can be launched remotely.

A denial of service vulnerability was found in rowboatlabs rowboat up to version 0.9.1, affecting the request.text/req.json function in the file apps/rowboat/app/api/composio/webhook/route.ts of the Composio Webhook Endpoint component. The attack can be launched remotely. Version 0.9.2 resolves the issue but removes the legacy Next.js app without security controls.

A path traversal vulnerability was found in Reader Tools PDF Reader App version 98.8 on Android. The issue affects the ActSplashNew.handleDeeplink function of the File Handler component. Manipulating the _display_name argument allows a local attack.

UpSignOn for Windows before version 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even after the application has been locked. Attackers can use the PROCESS_VM_READ permission to read the memory space of UpSignOn.exe and extract sensitive fields including entry names, URLs, usernames, passwords, TOTP secrets, and notes.

UpSignOn for Windows before version 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key stored in the Windows PasswordVault API without triggering any authentication prompt. Attackers can access the stored biometric key from a standard local process within the same Windows session to decrypt the protected vault files and export the entire password manager contents in cleartext.

UpSignOn for Windows before version 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers can extract the backup key from process memory to decrypt the encrypted master password backup stored in v6-vault1.DATA.txt, then use the recovered master password to decrypt the main vault and export all password manager entries in cleartext.

The SEOWriting plugin for WordPress through version 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious JavaScript by exploiting an overly permissive KSES allowlist that explicitly permits the onload event handler on iframe elements. Attackers can store crafted JavaScript payloads in post content that execute when the affected post is viewed or previewed by higher-privileged users, potentially leading to privilege escalation or account compromise.