CVE Vulnerability Catalog

Vulnerability in libssh. A malicious SFTP server can send responses for unknown request IDs, causing unbounded memory growth and client-side denial of service.

A flaw in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.

Vulnerability in Sparkle (software update framework for macOS) versions prior to 2.9.2. Insufficient symlink checking in delta application paths allows an attacker with a stolen EdDSA private key to deliver a malicious .delta file that, after signature verification, enables arbitrary file write outside the destination tree, including at root level when AppInstaller runs as root.

FlexCity software by Universal Software Inc. versions from 5.536.0 up to (but not including) 5.542.0 has improper restriction of excessive authentication attempts, allowing Excessive Allocation.

FlexCity software by Universal Software Inc. versions from 5.536.0 up to (but not including) 5.542.0 has an open redirect vulnerability, allowing input data manipulation.

FlexCity software by Universal Software Inc. versions from 5.536.0 up to (but not including) 5.542.0 has missing authorization, allowing exploitation of incorrectly configured access control security levels.

Spoofing vulnerability in the Address Bar component. This issue was fixed in Firefox 153 and Thunderbird 153.

Clickjacking vulnerability in the WebExtensions component in Firefox for Android. This issue was fixed in Firefox 153.

Vulnerability in OpenRemote before version 1.26.2. The SyslogResource REST endpoint (`GET /api/{realm}/syslog/event`) fails to filter operational logs by realm, allowing attackers with `read:rules` role to read logs from all tenants, including asset IDs, agent connection details, rule names, and protocol errors.

Grav is vulnerable to stored XSS in shortcode attributes because the XSS scan only matches literal angle brackets. An attacker with admin.pages permission can inject malicious JavaScript that executes in any viewer's browser, including administrators.

Vulnerability in Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 causes schema disclosure. Despite disabling public GraphQL introspection, variable coercion errors reveal 'Did you mean ...?' suggestions, allowing an unauthenticated attacker to recover hidden schema identifiers.

In libssh, when ProxyCommand is used, an unchecked fork() failure can result in storing PID -1. During cleanup, signals may be sent to processes in the caller's process tree, causing local denial of service.

A flaw in libssh: a remote authenticated client can issue SFTP_READ requests with an arbitrarily large length, causing the SFTP server to allocate excessive memory and potentially exhaust it.

A flaw in libssh: a remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing infinite channel write loops and CPU exhaustion.

A stack-based buffer overflow was found in rpcinfo utility from rpcbind. In short mode (rpcinfo -s), version numbers from a remote RPCBPROC_DUMP reply are written into a fixed-size stack buffer without bounds checking.

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0. This is due to missing capability checks on the `activate_tutor_free()` and `activate_elementor_free()` functions registered as `admin_action_*` handlers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate the Tutor LMS and Elementor plugins without proper authorization.

In libssh, during SFTP directory listing, the longname field is constructed via unsafe concatenation into a fixed-size stack buffer. Long filenames can overflow the buffer, leading to crashes or potential code execution on the server.

The Essential Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fancy Text Widget in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows users without permissions to view and modify BI packs and rules.

The WPBot WordPress plugin before version 8.2.0 does not perform capability or nonce checks in one of its retrieval-augmented-generation settings handlers. This allows authenticated users with subscriber-level access to modify the plugin's configuration.