CVE Vulnerability Catalog

Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in social_core/backends/open_id_connect.py places the OpenID Connect nonce in a shared OpenIdConnectAssociation table, and get_nonce and validate_claims verify only that the nonce exists and has not expired rather than binding it to the browser session and OAuth state. An attacker who obtains a victim's unused authorization code can start a separate login to obtain valid state for the attacker's browser, submit the victim's code with that state, and pass nonce validation because the victim nonce is globally available. With DEFAULT_USE_PKCE disabled, the attacker can be logged in as the victim.

The zip library for Rust in versions 0.6.0 through 8.x verifies the HMAC of an AES entry only when the data counter reaches zero. If the reader hits the real end of the archive while data_remaining is still positive, or an encrypted entry has no payload, a clean end of stream is returned without comparing the authentication tag. Applications using by_index_decrypt, by_name_decrypt, by_path_decrypt, or password-enabled by_index_with_options can accept modified plaintext without an authentication error.

The LearnPress plugin for WordPress in versions up to and including 4.4.11 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The flaw enables unauthorized access to functions that should be protected.

The LearnPress plugin for WordPress in versions up to and including 4.4.11 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The flaw enables unauthorized access to functions that should be protected.

The Gallery PhotoBlocks plugin for WordPress in versions up to and including 1.3.7 has a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. The flaw allows stored XSS.

The mall-server 0.0.1-SNAPSHOT application contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value. The order creation flow does not validate the resulting quantity and passes it to the stock update query, increasing inventory and creating negative-value orders.

OctoPrint version 1.0.0 has a vulnerability in the getSettings function in src/octoprint/server/ajax/settings.py, in the API Key Handler component. The manipulation causes information disclosure, and the attack can be carried out remotely. The exploit is publicly available, and the issue is fixed in version 1.1.0-rc1.

Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate selection, access decisions, and logging.

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process.

netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.

Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index. Remote TLS peers can drive handshake, renegotiation, or post-handshake messages into this buffer, triggering an out-of-bounds memcpy that crashes the JVM process.

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDom(string) never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like onload, executing script when applications render serialized document or body outer HTML.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Magepeople inc. WpEvently mage-eventpress allows Code Injection. This issue affects WpEvently: from n/a through 5.7.9.

A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0. Impacted is the function handleListIssues of the file src/handlers/issue-handlers.ts. Such manipulation of the argument state/labels leads to os command injection. The attack can be launched remotely. Upgrading to version 0.4.1 is recommended to address this issue.

A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Arm Keil MDK-Middleware versions 8.0.0–8.3.0 may allow DHCPv6 Option-Walk over-reads and unintended data retransmission. The issue affects the library's network stack.

Arm Keil MDK-Middleware version 8.3.0 may allow out-of-bounds reads and writes to the FTP Server RX buffer. The issue affects the library's FTP server component.

Arm Keil MDK-Middleware versions 8.0.0–8.3.0 may allow a pre-authentication out-of-bounds read in SNMP processing. The issue affects the library's SNMP component.

Syncplify Server! 6.0.0 before 8.8.0 contains a path traversal vulnerability that allows attackers to place a symbolic link inside a user's home folder to access files outside the virtual filesystem root, because confinement is enforced only against the requested path and not the on-disk destination of the link.

OpenJPEG versions 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. An attacker can exploit this to cause a denial of service.