CVE Vulnerability Catalog

A path traversal vulnerability has been discovered in DedeCMS 5.7.118 in the ExtractFile function of include/zip.class.php, used in the Album Publishing Feature. Manipulation of the filename argument allows remote exploitation.

A vulnerability in Nexus Repository 3 allows a user with Capability Administration permission to send HTTP requests to internal network locations (SSRF). The lack of destination URL validation in the global webhook configuration enables an attacker to use the server to scan or attack internal systems.

Nexus Repository 3 is vulnerable to Server-Side Request Forgery (SSRF) via the SSL Certificate Retrieval endpoint. A user with the nexus:ssl-truststore:read permission can cause the server to initiate outbound connections to internal or restricted network hosts.

The password plugin in Roundcube Webmail before versions 1.6.17 and 1.7.2 was vulnerable to username spoofing via session data, which could lead to account takeover.

In Roundcube Webmail before version 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a TNEF attachment.

In Roundcube Webmail before version 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was vulnerable to a denial of service (DoS) attack via a crafted compressed-RTF size.

A cross-site scripting vulnerability in Hi.Events before 1.11.0 allows authenticated attackers with event creation or edit permissions to inject arbitrary HTML and JavaScript by embedding a malicious event title containing the </script> sequence, which is not escaped by JSON.stringify() when embedded in inline script tags. Attackers can craft an event title that breaks out of the script context in the application/ld+json structured data block or server-side rehydrated state, causing the payload to execute in the browser of any user who views the public event page, including unauthenticated visitors and authenticated administrators.

A vulnerability in Hi.Events before version 1.11.0 allows unauthenticated attackers to purchase hidden tickets by referencing their IDs in order creation requests due to missing server-side authorization checks. Attackers can enumerate sequential hidden ticket IDs from visible ones and buy VIP, invite-only, or discounted tickets not intended for public sale.

A buffer over-read vulnerability in Fortinet FortiOS and FortiProxy allows an attacker to disclose information by reading beyond the allocated buffer. This issue affects multiple versions of these products.

A path traversal vulnerability in FortiOS, FortiPAM, and FortiProxy allows an attacker to execute unauthorized code or commands by manipulating file paths.

A stack-based buffer overflow vulnerability in FortiOS, FortiPAM, and FortiProxy allows a privileged authenticated attacker to bypass stack protection and ASLR, then execute arbitrary code or commands via crafted HTTP requests.

Pillow library versions 12.0.0 through 12.2.0 have a vulnerability in the EPS parser (PIL/EpsImagePlugin.py) that allows an infinite loop via a crafted EPS file with a negative byte count in the %%BeginBinary directive. An attacker can exploit this to cause a denial of service (DoS) when opening a malicious file with Image.open().

In Pillow library versions 5.2.0 through 12.3.0, a vulnerability exists in the TGA RLE encoder. When saving a mode 1 image with RLE compression, the encoder reads past its packed row buffer, causing adjacent process heap bytes to be copied into the generated TGA file. The issue is fixed in version 12.3.0.

A Cross-Site Scripting (XSS) vulnerability in FortiOS, FortiPAM, and FortiProxy allows an authenticated remote user to execute code or commands via crafted requests.

A vulnerability was found in spencermountain compromise up to version 14.15.1, where the nlp.extend function in src/API/extend.js allows improper modification of object prototype attributes. Remote exploitation is possible and a public exploit exists.

A vulnerability in mingo up to version 7.2.1 allows improperly controlled modification of object prototype attributes via the update/updateOne/updateMany functions. The attack can be launched remotely by manipulating the Set argument.

A vulnerability was found in svg.js up to version 3.2.5 in the EventTarget.on function. Input manipulation can lead to uncontrolled modification of object prototype attributes. The attack can be initiated remotely.

An authorization bypass vulnerability in Nexus Repository 3's component upload API allows a user with only read/browse privileges on a Swift, Terraform, or Conda hosted repository to upload arbitrary artifacts, bypassing the intended write-permission check.

A path traversal vulnerability in the legacy messaging sent-mail attachment download functionality of openSIS Classic 9.3 allows an authenticated attacker to read arbitrary files on the server via crafted path traversal sequences.

A buffer over-read vulnerability in Fortinet FortiOS allows an authenticated remote attacker to read a portion of device memory by submitting a specially crafted request. The issue affects multiple FortiOS versions from 6.4 to 7.6.3.