CVE Vulnerability Catalog

Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher allowing unauthenticated attackers to crash the server process by sending malformed or incomplete protobuf messages.

Perspective 5.0.0 contains a remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary OS commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes input directly to Python's eval().

VibeSurf up to cd6e519d507cdd4d63061300bf60fb176e1f57e0 has a code injection vulnerability in the Python Validation Handler component in the /code file, allowing remote code execution.

Liman MYS from 2.2.3 before 2.3.1 has a missing authorization vulnerability allowing privilege escalation.

A vulnerability in the ATT layer of the Bluetooth stack in Zephyr OS leads to a use-after-free of channel memory. When a remote device disconnects during ongoing ATT traffic, a deferred callback may reference a freed channel, causing a system crash or potential memory corruption.

Liman MYS from 2.2.3 before 2.3.1 has a missing authorization vulnerability allowing access to functionality not properly constrained by ACLs.

Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding.

Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.

Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters.

Vulnerability in Koha's reports/catalogue_stats.pl where dynamic SQL is built by interpolating user-controlled Line and Column parameters directly into identifier positions of the query without whitelist validation.

Vulnerability in Koha's reports/acquisitions_stats.pl where the per-cell statistics query is built by interpolating user-controlled Filter parameters directly into WHERE fragments covering multiple fields.

Eclipse Milo versions 0.6.0 through 1.1.4 have a vulnerability where UASC server transport handlers fail to release retained partial message chunks on disconnect, allowing a remote unauthenticated client to exhaust pooled direct memory and potentially terminate the server.

Eclipse Milo versions 1.0.0 through 1.1.4 have a vulnerability in the Call service that dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or low-privileged client to execute a denied method by batching it with an allowed method.

In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a CreateMonitoredItems event filter can trigger a StackOverflowError during decoding, allowing an unauthenticated remote client to exhaust a finite global monitored-item quota and prevent all clients from creating new monitored items until restart. Existing monitored items and other server functions remain unaffected.

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures. This allows an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated ActivateSession requests as a padding oracle, recover the victim's password, and authenticate with the recovered credentials.

Eclipse Milo versions 1.0.0 through 1.1.4 have a vulnerability where OpcUaServerConfig.copy() fails to preserve a configured RoleMapper, leading to skipped role-permission checks and allowing an anonymous client to access protected data and operations.

External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows removing important client functionality.

A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow in fbxsdk::ExtractDrive, allowing arbitrary code execution in the context of the current process.

A maliciously crafted FBX file parsed through Autodesk FBX SDK can trigger a stack-based buffer overflow in fbxsdk::FbxIO::BinaryReadSectionHeader.

HUMANIST Digital Human Resources by Bilin Software and Informatics Consultancy Inc. has a Session Hijacking vulnerability due to use of GET request method with sensitive query strings. Affects versions from 26.0 before 26.1.