CVE Vulnerability Catalog

A vulnerability in NSD involves a HIP resource record that fills RDATA near its limit and has another dname RDATA field (a HIP Rendezvous server), which can overwrite the stack with up to 191 bytes of attacker-controlled data.

A vulnerability in NSD involves SVCB or HTTPS RRs that fill the wire format RDATA to the brim, where another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker-controlled data of unlimited size.

A vulnerability in NSD involves base64 data split into pieces of 3 characters or less, where tokens are incorrectly calculated to produce 0 bytes, enabling attackers to overwrite the stack with up to 64K of attacker-controlled data.

The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode. This allows unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests.

A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers). An out-of-bounds write vulnerability exists in the DCI parsing function, where a reserved field value is incorrectly accepted, causing the parser to write beyond the bounds of an internal structure. An attacker could exploit this by providing a specially crafted H.266 bitstream to a third-party application that uses this library API, potentially causing a crash or memory corruption. No standard GStreamer pipeline element currently invokes the affected code path.

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can cause a file to be written outside the intended extraction directory.

A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy forwards requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. A pipelined second request is relayed verbatim to the backend, bypassing the configured path restrictions.

A heap buffer overflow was found in gst-plugins-base. It can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets exceeding the actual backing memory allocation. The metadata is not range-checked during deserialization, and the frame mapping code does not verify that the declared plane geometry fits within the buffer.

HPE NonStop MODULAR NSJ contains a predictable seed vulnerability in Random Number Generation (PRNG).

HPE NonStop Middleware software has a secret key handling and data deserialization vulnerability. Technical details were not provided in the description.

A security vulnerability in HPE NonStop Java JToolkit can allow command injection and buffer overflow.

A security vulnerability in HPE NonStop Hpjmeter can cause stack and heap buffer overflow.

A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem.

A flaw in the clevis PKCS#11 pin: the clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without restrictive permissions. Under the default umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the decryption script exits early, leaving the PIN accessible indefinitely.

A flaw in the clevis PKCS#11 pin: the clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive umask, any local user can connect to the control socket and inject arbitrary device/key pairs, or connect to the data socket to receive LUKS passphrases.

A flaw in the GStreamer multimedia framework's ASF muxer plugin (asfmux). When writing string metadata tags containing Unicode characters outside the Basic Multilingual Plane (such as emoji) to an ASF container, the plugin incorrectly calculates the buffer size needed for the UTF-16LE representation. The size calculation assumes each Unicode code point requires 2 bytes, but non-BMP characters require 4 bytes (surrogate pairs). This leads to a heap out-of-bounds write when the actual UTF-16LE conversion is written into the undersized buffer. An attacker could exploit this by providing media with crafted metadata tags to an application that transcodes or remuxes to ASF format while preserving metadata, potentially causing a denial of service or limited memory corruption.

A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and system shutdown. Technical details were not provided in the description.

A vulnerability in the customer invoicing web application exposes personally identifiable information (PII) and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised individuals. The issue is caused by a lack of authorisation checks at the endpoint serving PDF invoice files. Furthermore, some invoicing document URLs appear to be publicly accessible via search engines, exposing paths to confidential files.

The Paid Videochat Turnkey Site (ppv-live-webcams) plugin for WordPress is vulnerable to Reflected Cross-site Scripting due to improper neutralization of input during web page generation. This issue affects versions from n/a through 7.5.12.

External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained.