CVE Vulnerability Catalog

A denial-of-service vulnerability in facil.io 0.6.0 through 0.7.6 in the multipart body parser allows unauthenticated remote attackers to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary, exhausting all workers and disabling the server until manual restart.

facil.io versions 0.6.0 through 0.7.6 contain an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. Attackers can trigger a uint32_t wraparound in http_mime_parser.h causing an out-of-bounds memory read past the name pointer, resulting in a bus fault that crashes the handling worker with a single POST request.

A vulnerability in NVIDIA NeMo for Linux allows an attacker to cause OS command injection, potentially leading to code execution, data tampering, privilege escalation, and information disclosure.

A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. This vulnerability requires a minimum role of Enterprise Standard Admin. The issue was discovered internally by Arista and is not known to be exploited in customer networks.

A vulnerability in phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing_image field during category updates, allowing authenticated attackers to delete arbitrary files by exploiting insufficient sanitization in Image::delete(). Attackers can delete the database.php configuration file to disable the installation gate and access the public setup wizard to create new superadmin accounts.

A vulnerability in SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary code in the Electron renderer with full Node.js access when victims open affected documents.

A vulnerability in SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML parser treats as raw text but browsers interpret as executable SVG content when served as image/svg+xml, enabling script execution in the application origin.

A resource allocation vulnerability in Erlang/OTP's public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during TLS handshake. The certificate policy tree grows without bounds, exhausting BEAM schedulers and node memory, crashing the entire VM. This affects all TLS connections that validate peer certificates by default.

A classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory (potentially leading to remote code execution or denial of service) by sending a single H.248/Megaco message with an oversized property name. The flaw occurs in mfs_load_property_groups, which uses an unchecked sprintf to write into a fixed 512-byte error_msg field, overwriting adjacent struct fields and enabling arbitrary write and free primitives in the BEAM VM process.

A vulnerability in the Erlang/OTP SSL application allows memory exhaustion by sending a crafted certificate chain during TLS/DTLS handshake. Lack of cycle detection in the certificate chain building function causes unbounded recursion, leading to BEAM node crash.

The TLS 1.2 (and earlier) and DTLS client in Erlang/OTP does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client. An on-path attacker can select an anonymous cipher suite, bypassing certificate and hostname verification, allowing interception and modification of traffic.

In Erlang OTP, a signed to unsigned conversion error and out-of-bounds heap write vulnerability exists when decoding a crafted ETF binary via binary_to_term/1. This can corrupt the BEAM heap pointer and crash the virtual machine.

A vulnerability in the External Term Format (ETF) decoder in ERTS causes an integer underflow when processing crafted binary data. This leads to allocating huge memory and crashing the entire Erlang/VM node.

In Erlang OTP (epmd), a connection slot exhaustion vulnerability allows an unauthenticated remote attacker to permanently terminate the epmd daemon. The do_accept function incorrectly treats EMFILE/ENFILE errors as fatal instead of recoverable.

SQL Injection vulnerability in the admin panel of WP Google Review Slider plugin up to version 18.4. Allows an administrator to execute arbitrary SQL queries.

A path traversal vulnerability in NitroShare Desktop up to version 0.3.4 allows unauthenticated attackers on the same LAN to write files outside the transfer directory. Attackers can place files in the Windows Startup folder, enabling persistent code execution.

Unauthenticated Cross-Site Scripting (XSS) vulnerability in the Booking Calendar plugin up to version 11.4.2. Allows an attacker to inject malicious scripts into the page.

Unauthenticated Cross-Site Scripting (XSS) vulnerability in the Dynamic Pricing With Discount Rules for WooCommerce plugin up to version 4.5.11. Allows an attacker to inject malicious scripts.

Unauthenticated Cross-Site Scripting (XSS) vulnerability in the Product Feed Manager plugin up to version 7.6.1. Allows an attacker to inject malicious scripts.

Unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the 3D Flipbook PDF Viewer & Embedder plugin up to version 1.4.2. Allows an attacker to make requests from the server to internal resources.