CVE Vulnerability Catalog

HumHub 1.18.4 contains a stored cross-site scripting (XSS) vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason.

IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service and compromise data integrity due to a time-of-check time-of-use race condition.

The Joomla extension J-BusinessDirectory before version 6.2.3 contains a DoS vulnerability in pagination parameter handling. Pagination values were not strictly typed. Array/non-numeric values (for example limitstart[]) could trigger PHP type errors in arithmetic, and limit was not validated before use in list queries.

Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The sync_command binary forwards unsanitized input directly to a shell execution sink in command.lua, enabling attackers with access to the MQTT broker to exploit the default-enabled command execution path to achieve full root-level system compromise.

Dell OpenManage Enterprise versions prior to 4.7.0 contain an SQL injection vulnerability. A low privileged attacker with remote access could exploit this, leading to information exposure.

Dell Command Update (DCU) versions prior to 5.7.1 contain a Missing Authorization vulnerability. A low privileged attacker with local access could exploit this, leading to elevation of privileges.

Dell Command Update (DCU) versions prior to 5.7.1 contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could exploit this, leading to filesystem access.

Dell Command Update (DCU) versions prior to 5.7.1 contain a Missing Authorization vulnerability. A low privileged attacker with local access could exploit this, leading to unauthorized access.

Dell Command Update (DCU) versions prior to 5.7.1 contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could exploit this, leading to elevation of privileges.

Dell Command Update (DCU) versions prior to 5.7.1 contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could exploit this, leading to elevation of privileges.

jxl-oxide, a pure Rust implementation of a JPEG XL decoder, prior to jxl-grid 0.6.2, contains a vulnerability in length calculations on 32-bit platforms when decoding a crafted JPEG XL image. This can lead to out-of-bounds writes, memory corruption, denial of service, or arbitrary code execution.

Algernon, a small self-contained pure-Go web server, prior to version 1.17.9, on Windows contains a vulnerability in file handler selection for NTFS-equivalent names such as x.lua::$DATA. An unauthenticated client can access raw source code of server-side scripts, potentially exposing database credentials, API keys, and the SetCookieSecret value.

Dell Command Update (DCU) versions prior to 5.7.1 contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could exploit this, leading to elevation of privileges.

Dell Command Update (DCU) versions prior to 5.7.1 contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could exploit this, leading to elevation of privileges.

The SimpleSAMLphp SAML2 library in versions 4.19.2 and 4.20.2 allows attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume uncontrolled processing resources, allowing a remote unauthenticated attacker to deny service. This issue is fixed in versions 4.19.3 and 4.20.3.

The SimpleSAMLphp SAML2 library prior to versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1 has a vulnerability in the HTTPArtifact::receive() flow that can treat an unsigned embedded SAML Response as cryptographically valid for the wrong identity provider. In a multi-IdP federation, a malicious or lower-trust IdP can impersonate a higher-trust victim IdP and authenticate as arbitrary users. This issue is fixed in versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1.

electerm prior to version 3.11.11 constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf(), mv(), and cp() functions. A malicious SSH or SFTP server can provide a filename containing quote characters and shell metacharacters, leading to arbitrary command execution with the desktop user's privileges. This issue is fixed in version 3.11.11.

electerm prior to version 3.11.11 uses remote-supplied filenames directly with path.join() while receiving Zmodem and Trzsz transfers. A malicious SSH server can provide a filename containing traversal components such as ../, allowing writes outside the selected download directory and overwriting files accessible to the desktop user. This issue is fixed in version 3.11.11.

SSHFS from version 1.4 until 3.7.6 accepts a bracketed mount source such as [-oProxyCommand=CMD]:/path and find_base_path() removes the brackets, leaving a host value that begins with - and is passed directly to ssh as a command-line argument. When a caller also supplies a path-valued sftp_server, an injected ProxyCommand can execute locally before any connection or authentication succeeds. This issue is fixed in version 3.7.6.

Gotenberg from version 8.10.0 until 8.33.0 has a race condition in the newContext function in pkg/modules/api/context.go, where multiple goroutines concurrently write to shared maps and slices. A crafted multipart request with many downloadFrom entries can trigger a fatal 'concurrent map writes' runtime error and terminate the process. The default configuration allows unauthenticated remote attacks, leading to denial of service. This issue is fixed in version 8.33.0.