CVE Vulnerability Catalog

TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authenticated ONVIF client can submit an excessive number of preset-related elements, causing writes beyond fixed-size stack arrays and crashing the service.

TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP (TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram can cause an invalid indirect call, crashing the main service and resulting in denial of service. No authentication, session, or pairing is required.

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template context. Attackers can craft a custom link template embedding request.COOKIES['sessionid'] or a user's API token into an img src URL, bypassing the clean_html sanitizer and auto-exfiltrating the victim's credentials. This enables full account takeover.

Dell Command | Configure (DCC) versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to information disclosure.

A missing authorization vulnerability in GitHub Enterprise Server allowed a repository collaborator with write access to delete the current default branch via the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories requiring pull-request review but not restricting branch deletion, this bypassed the review requirement and caused fresh clones and default-branch API requests to use attacker-controlled content.

Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39. A remote attacker could execute arbitrary code via a crafted HTML page. (Severity: High)

In the is_pd_allowed function in gem_msg.c, there is a missing permission check, allowing a permission bypass. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors. By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection attempts, an attacker can trigger an unthrottled retry loop, leading to high CPU utilization and service stalls.

Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. This issue affects multiple WordPress versions from 6.6 through 7.1.2.

In ImageSharp versions 3.0.0 through 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expanded runs to BitWriterUtils.WriteBits without first checking the current row width. T4TiffCompression.WritePixelRun can accumulate oversized makeup-code runs, and ModifiedHuffmanTiffCompression.Decompress validates the width only after writing. The unchecked writes can overflow the strip buffer, corrupt heap memory, and terminate the process. The issue is fixed in version 4.1.1.

In ImageSharp from 2.0.0 to 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ReadValue64 returns without advancing the stream or terminating the loop, allowing a small malformed BigTIFF to keep a decoder thread executing for an attacker-controlled duration. Fixed in 4.1.2.

In ImageSharp versions 2.1.0 through 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode performs unchecked writes, and a decode-and-re-encode flow can inherit TiffCompression.CcittGroup4Fax and one-bit metadata from attacker-supplied input. The resulting out-of-bounds writes can corrupt memory and terminate the process. The issue is fixed in version 4.1.2.

In ImageSharp from 1.0.0-beta0001 to 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared dimensions before confirming the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and earlier parsing paths can allocate large jagged representations from a short truncated profile. In version 4, automatic conversion reaches the parser when ColorProfileHandling is Convert; default Preserve avoids that path. Fixed in 4.1.2.

In ImageSharp versions 2.0.0 through 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the resulting value as an unchecked histogram offset, causing an unsafe out-of-range access and process termination. Adaptive Histogram Equalization and AutoLevel are not affected. The issue is fixed in version 4.1.2.

In ImageSharp versions 4.0.0 through 4.1.2, ICC LUT16 conversion accepts more than four output channels even though ClutCalculator.Calculate and LutEntryCalculator.CalculateLut store intermediate and output values in Vector4. When DecoderOptions.ColorProfileHandling is set to Convert, a malformed embedded profile can direct interpolation and output-LUT operations to write one float per declared channel beyond the four-float destination. This can corrupt memory and terminate the process; the default Preserve mode does not run ICC conversion. The issue is fixed in version 4.1.2.

In ImageSharp from 4.0.0 to 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result shorter than the required EXR block size. ZipExrCompression.Decompress reconstructs the returned prefix while ExrDecoderCore processes the full expected block from a buffer obtained through Configuration.Default, allowing bytes from a completed prior ImageSharp operation to appear in decoded pixels. Applications exposing pixels or output from the later attacker-controlled EXR decode can disclose process-local image data. Fixed in 4.1.2.

In ImageSharp versions 2.0.0 through 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T4 end-of-line codes, and T4BitCompressor.CompressStrip reaches unchecked writes when TiffCompression.CcittGroup3Fax is selected directly or inherited from decoded TIFF metadata. An attacker-controlled encode or decode-and-re-encode flow can write beyond the logical output span, corrupt process memory, and terminate the process. The issue is fixed in version 4.1.2.

In Quasar Framework from 1.0.0 to 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external directories. An unsafe trusted configuration can delete data writable by the build user before compilation begins. No attacker-controlled input reaches build.distDir by default, so exploitation requires compromised or less-trusted automation or a mistaken configuration. Fixed in 3.3.0.

Quasar Framework prior to 3.3.0, in several @quasar/app-vite SSR and SSG rendering paths, interpolates ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides this value with attacker-controlled data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generated HTML. Cryptographically generated base64 or base64url nonces are not affected because they lack HTML attribute delimiters. The issue is fixed in version 3.3.0.

Quasar Framework prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0: renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closing-tag spelling, so case variants and valid closing-tag delimiter variants could terminate the script element and inject markup. The issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0.