CVE Vulnerability Catalog

Jenkins versions 2.567 and earlier, LTS 2.555.2 and earlier improperly determine that a redirect URL after login legitimately points to Jenkins when it contains relative path segments (`./` or `../`), allowing attackers to perform phishing attacks.

Ghidra before 12.1.1 contains an uncontrolled memory allocation vulnerability in the Mach-O binary parser that allows attackers to cause denial of service. An attacker can supply a crafted Mach-O binary with an arbitrarily large ncmds load command count value, forcing the parser to allocate excessive heap memory without validating file size, crashing the Ghidra JVM.

Ghidra before version 12.1 contains a heap-use-after-free vulnerability in the decompiler's HighVariable::merge() function during the variable merging pass. Attackers can trigger this vulnerability by crafting a binary that causes stale pointers in the HighIntersectTest::highedgemap cache to be dereferenced, reading and writing the flags field of freed heap memory when a user opens the binary in Ghidra's decompiler view.

Ghidra before version 12.2 contains an unauthenticated path traversal vulnerability in the IsfServer that accepts TCP connections and passes client-supplied namespace strings directly to filesystem operations without validation. Remote attackers can connect to port 54321 and send crafted protobuf messages with traversal sequences to enumerate filesystem paths and probe arbitrary files.

Ghidra before version 12.0.3 contains an out-of-memory vulnerability in the rust_demangle function that allocates unbounded output buffers without size limits. Attackers can craft malicious Rust symbol names in binaries to trigger exponential memory allocation, causing process crashes during binary analysis.

A heap-use-after-free vulnerability in the SLEIGH library before version 12.1 (Ghidra) exists in SleighBuilder::generatePointerAdd due to iterator invalidation when PcodeCacher::allocateInstruction reallocates the issued vector.

Ghidra versions 10.2 through 12.0 contain an uncontrolled resource consumption vulnerability in ExportTrie.parseTrie() lacking cycle detection when processing Mach-O export tries. A crafted Mach-O binary with circular references causes unbounded queue growth and exponential string concatenation, leading to OutOfMemoryError and JVM crash.

Debusine is an integrated solution to build, distribute, and maintain a Debian-based distribution. The parser used to read manifest files accepted arbitrary fully user-controlled paths, potentially allowing the creation of arbitrary symbolic links on a worker.

Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Endpoints that create and delete relationships between artifacts enforced no permissions checks beyond being able to see the artifacts in question.

Stored Cross-Site Scripting (XSS) vulnerability in the Easy Image Collage plugin for WordPress up to version 1.13.6. The issue is due to insufficient input sanitization and output escaping in the 'grid[properties][borderColor]' and 'grid[images][N][attachment_url]' parameters. Authenticated attackers with author-level access and above can inject arbitrary scripts, and unfiltered_html restrictions do not apply because data is stored via update_post_meta().

Stored Cross-Site Scripting (XSS) vulnerability in the MW WP Form plugin for WordPress up to version 5.1.3. The issue is due to insufficient input sanitization and output escaping in the 'memo' parameter. Authenticated attackers with editor-level access and above can inject arbitrary scripts, and WordPress's built-in kses and unfiltered_html protections do not apply because data is stored via update_post_meta().

Stored Cross-Site Scripting (XSS) vulnerability in the aThemes Addons for Elementor plugin for WordPress up to version 1.1.8. The issue is due to insufficient input sanitization and output escaping in the 'title_tag' widget setting. Authenticated attackers with contributor-level access and above can inject arbitrary scripts. This affects the Posts Timeline and Posts Carousel widgets (including Default, Banner, and Modern skins), which omit the whitelist validation.

Vulnerability in Dahua products allows an authenticated remote attacker to send a crafted packet, causing an exception and unexpected system reboot, leading to denial of service.

An attacker who intercepts and tampers with traffic between the client application and the API Gateway server could potentially deserialize arbitrary objects. This vulnerability could lead to broken security expectations or remote code execution.

The Animation Addons for Elementor WordPress plugin up to version 2.6.7 has a DOM-Based Stored XSS vulnerability via multiple parameters due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary scripts.

File Station 6 has a resource allocation without limits vulnerability. A remote attacker who gains a user account can exploit it to prevent other systems, applications, or processes from accessing the same type of resource.

A path traversal vulnerability has been reported in several QNAP operating system versions. A remote attacker with an administrator account can read unexpected files or system data.

File Station 6 has a NULL pointer dereference vulnerability. A remote attacker who gains a user account can exploit it to launch a denial-of-service (DoS) attack.

License Center prior to version 1.9.56 contains a path traversal vulnerability. A local attacker with an administrator account can read the contents of unexpected files or system data.

ESF-IDF (Espressif IoT Development Framework) versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0 contain an out-of-bounds read vulnerability in the BlueDroid AVRCP vendor-command parser (avrc_pars_vendor_cmd). Patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.4, and 6.0.1.