CVE Vulnerability Catalog

CWE-269 vulnerability in Johnson Controls victor Web on Windows allows CAPEC-233. This issue affects victor Web: before 7.1.

Deserialization of untrusted data vulnerability in Johnson Controls victor, CCure 9000, and Victor Application Server. Allows CAPEC-586 attack.

Johnson Controls CCure 9000 and Victor Application Server versions 2.9 through 3.0 contain a Server-Side Request Forgery (SSRF) vulnerability.

Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments.

An out-of-bounds read vulnerability in the product may allow an attacker to crash the parsing process and cause a denial of service.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

Progress MOVEit Transfer suffers from insufficient session expiration. An attacker can exploit an unexpired session to gain unauthorized access.

Progress MOVEit Transfer has a permissive cross-domain security policy, allowing communication with untrusted domains. This can lead to cross-domain attacks.

Progress MOVEit Transfer contains an improper authentication vulnerability. An attacker can bypass authentication mechanisms and gain unauthorized access.

An out-of-bounds write vulnerability in the vf_swaprect video filter in FFmpeg versions 3.0 through 8.1.2. An attacker can supply a crafted NV12 frame with odd width, causing heap corruption and potential code execution.

A vulnerability in the vf_floodfill video filter in FFmpeg versions 3.4 through 8.1.2 causes an out-of-bounds write on the heap. When config_input() allocates a stack based on initial frame dimensions and a larger frame is processed, filter_frame() pushes neighbors beyond the original allocation, leading to heap corruption and potential code execution.

A vulnerability in FFmpeg through version 8.1.2 allows heap corruption via a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, resulting in a negative size that, when converted to size_t in shorten_decode_frame(), causes reads beyond the source and writes beyond the Shorten decoder's bitstream buffer.

FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file.

gpsd up to release-3.27.5 contains a code injection vulnerability in gpsprof, where an attacker controlling GPS input can inject arbitrary OS commands via the SKY.satellites[].used field, which is unsanitized in a gnuplot heredoc.

In nebula-mesh before version 0.3.2, in internal/configgen/generator.go, the ListenHost and TunDevice fields are interpolated without validation into a text/template, potentially leading to code injection. internal/web/advanced.go accepts these fields with only whitespace trimming, no character or shape validation.

In the Quinn library (a Rust implementation of the QUIC protocol), a vulnerability exists in the Assembler component that reassembles unordered stream fragments. An attacker can send fragments with many gaps, causing excessive buffering and memory exhaustion.

The WPO365 | Login plugin for WordPress up to version 43.2 is vulnerable to Cross-Site Request Forgery. The Ajax request verification can be disabled, allowing an unauthenticated attacker to overwrite arbitrary plugin options, including enabling the SCIM REST endpoint, setting a known SCIM token, and assigning administrator role to new users.

Chatwoot before version 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation, then obtain signed PUT URLs to write arbitrary data to the application's storage backend.

The default serve() path in Amazon aws-smithy-http-server lacks connection and header-read timeouts and a concurrent-connection cap, allowing remote attackers to cause a denial of service by opening many connections and sending partial requests.

Meshery before version 1.0.57 has an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints. The file parameter is passed directly to os.Open without path validation, allowing reading arbitrary files from the host filesystem.