CVE Vulnerability Catalog

cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service. Because project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions.

This vulnerability exists in CP PLUS EZ-P21 IP Camera due to improper authentication of HTTP endpoints. A remote attacker could exploit this vulnerability by conducting brute-force attacks against HTTP endpoint on the targeted device. Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to live video snapshots from the targeted device.

This vulnerability exists in CP PLUS EZ-P21 IP Camera due to an insecure debug feature enabled in the firmware. An attacker with physical access could exploit this vulnerability by placing arbitrary code on removable media and triggering their execution through the debug mechanism. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code with elevated privileges on the targeted device.

In the rtl8723bs driver in the Linux kernel, the loop in is_ap_in_tkip() does not properly validate buffer bounds when processing information elements (IEs). This can lead to an out-of-bounds (OOB) read when accessing the IE header or its data.

In the NTFS3 filesystem in the Linux kernel, the log_replay() function does not validate the lcns_follow field during record conversion. A malicious filesystem image can provide an oversized lcns_follow value, causing an out-of-bounds (OOB) read during the memmove operation.

In the NTFS3 filesystem in the Linux kernel, the UpdateRecordDataRoot and UpdateRecordDataAllocation functions do not validate the view.data_off field in the NTFS_DE structure. A malicious filesystem image can provide an oversized view.data_off value, causing an out-of-bounds (OOB) write during the memmove operation.

In the Linux kernel's Open vSwitch module, a vulnerability was found due to missing validation of nested action attribute sizes. An attacker can exploit this to create oversized action containers, leading to incorrect stream interpretation and potential system integrity compromise.

Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verification of the SSH enable file signature and enable SSH access on the device. Successful exploitation may result in unauthorized administrative access and complete system compromise.

The bookingpress-appointment-booking-pro WordPress plugin before version 5.7.3 incorrectly implements its REST permission callback. This allows unauthenticated attackers to access API routes, read customer booking data, and modify other users' bookings.

The Download Manager WordPress plugin before version 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly. The token becomes a long-lived, multi-use, portable bearer token. An attacker who obtains one leaked download key can repeatedly download a role- or password-protected package file without authorization.

The MPG WordPress plugin before version 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response. Unauthenticated attackers can perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.

The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix, so an unauthenticated user who registers an account can be granted the administrator role when a correspondingly named field has been configured.

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrary orders as paid by replaying a single genuinely-approved payment reference (for example one obtained from their own minimal purchase).

The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request.

The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before version 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization check. This allows unauthenticated attackers to read arbitrary local files (including configuration files containing database credentials and secret keys) and to make server-side requests to internal resources.

XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page component.

Vulnerability allowing external parties to access files and directories in Microsoft Edge (Chromium-based). An unauthorized attacker can disclose information over a network.

Origin validation error in Microsoft Edge (Chromium-based). An unauthorized attacker can disclose information over a network.

NoteGen before version 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments by default. JavaScript in the application webview can invoke plugin:shell|execute to run attacker-controlled OS commands with NoteGen process privileges.

NoteGen before version 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML without HTML sanitization and with CSP set to null. Attacker-controlled content can cause the model response to include executable markup, leading to XSS in the application context.