CVE Vulnerability Catalog

xrdp versions up to 0.10.6 contain an out-of-bounds read vulnerability during processing of RDP Confirm Active PDU. Insufficient length validation of capability sets allows an unauthenticated remote attacker to send a crafted RDP packet, potentially causing a process crash and denial of service (DoS).

Revive Adserver 6.0.7 contains a CSRF vulnerability in the `zone-include.php` script. Linking and unlinking banners or campaigns to zones can be triggered via crafted GET or POST requests without CSRF token verification, allowing an attacker to perform these actions on behalf of an authenticated administrator.

In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `properties_parse()` allows an authenticated attacker to crash the NanoMQ broker by sending a POST request to `/api/v4/mqtt/publish` with `user_properties` as a JSON array instead of a JSON object. The crash occurs because `strlen()` is called on a NULL `item->string` pointer when iterating over array elements.

xrdp versions up to 0.10.6 contain a heap out-of-bounds read vulnerability in FIPS-specific receive paths. The vulnerability does not affect the default configuration and requires security_layer=negotiate or security_layer=rdp and crypt_level=fips in xrdp.ini. An unauthenticated remote attacker can send a crafted FIPS-protected PDU, causing a process crash and denial of service (DoS).

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to response time discrepancies, a remote attacker can infer the existence of a username on the system, leading to unauthorized information disclosure via username enumeration. Fixed in version 0.10.6.1.

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts requiring a second authentication factor (typically TOTP), an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication. As a workaround, apply the patch from commit da18a16c84ae5c0b78cad79609cb0efb174000ec manually.

libvips versions up to 8.18.1 have a vulnerability in the EXIF decoder. Missing range verification of EXIF tag groups can cause a null pointer dereference and crash. Fixed in version 8.18.2.

NanoMQ contains a protocol-semantics flaw in its MQTT v5 SUBSCRIBE handling. If a subscription entry is missing the final 1-byte Subscription Options field, the broker may accept the malformed packet and install the subscription. Under specific conditions, the same parser flaw also causes a 1-byte out-of-bounds read detected by ASAN as a heap-buffer-overflow.

libvips versions up to 8.18.0 on 32-bit systems have a vulnerability in the gifload operation. Incorrect dimension determination can lead to an integer overflow. Fixed in version 8.18.1.

In dataCycle-CORE before version 26.06.08, the application exposes server-side state changes through `GET` routes. Because browsers automatically send cookies on same-site top-level navigation and Rails does not apply CSRF protections to `GET`, an attacker can force a logged-in victim to modify application state by embedding a link, image, iframe, or redirect to one of these endpoints.

In dataCycle-CORE before version 25.07.3, a Standard user can enumerate other users' names and email addresses through the /users/search endpoint, even though direct access to user profiles is denied.

A stored cross-site scripting (XSS) vulnerability has been discovered in Bifra Engineering Consulting Ltd.'s Q-smart NexT Poll due to improper input neutralization during web page generation. This allows an attacker to inject malicious scripts that execute in other users' browsers.

HeyForm before version 3.0.0-rc.9 does not properly validate `hiddenFields` submitted by users. An anonymous user can inject arbitrary key-value pairs, including XSS payloads, which are then forwarded to webhooks.

rConfig Core before version 8.2.8 contains a privilege escalation vulnerability. Authenticated users can assign arbitrary roles to any account via an unvalidated role field in the Users API, without admin-level authorization checks.

A directory traversal vulnerability in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via a crafted request.

Mailpit before version 1.30.1 has a DoS vulnerability in four JSON API endpoints with no body size limit, allowing an unauthenticated remote attacker to cause significant memory consumption.

Rust OneNote File Parser before version 1.1.1 allows opening arbitrary files outside the notebook directory via a crafted .onetoc2 file. An attacker can probe file existence or cause denial of service.

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the `/api/upload` endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored in the static assets directory and served with `Content-Type: image/svg+xml` by Express's serve-static middleware, allowing an attacker to achieve stored cross-site scripting (XSS) on the heyform domain without any authentication. Version 3.0.0-rc.7 contains a patch for the issue.

Mailpit prior to version 1.30.0 has a vulnerability in the screenshot/print proxy (/proxy?data=…) where an unsynchronized map read during concurrent writes causes a fatal Go error (concurrent map read and map write), crashing the entire Mailpit process.

Path traversal vulnerability in Mailpit before version 1.30.0. The message ID field is taken verbatim from the JSON response and concatenated into the output path with path.Join, which normalizes '..' segments. A malicious server impersonating Mailpit can write attacker-controlled bytes to any path the running user can write.