CVE Vulnerability Catalog

The Regular Labs conditions manager for Joomla! trusts spoofable forwarded headers for IP and GeoIP conditions, allowing remote clients to bypass location-based rules.

The Regular Labs Conditions Manager for Joomla did not consistently check CSRF tokens or component/mapped-item permissions during condition administration. An unauthorized backend user or CSRF attack could modify conditions.

AJAX endpoints in various Regular Labs extensions for Joomla did not consistently require valid CSRF tokens, matching component/item permissions, or trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization.

The OIDC::Lite Perl library up to version 0.12.1 allows ID Token signature verification bypass via a token-controlled algorithm allowlist. When the caller does not pin an algorithm, verify sets the algorithm from the token header and passes it to decode_jwt as the allowed list. A token with alg=none returns claims without signature check, and a token with alg=HS256 is verified with the RSA public key as HMAC secret (RS to HS confusion).

A vulnerability in the unrar.dll component of IZArc version 4.6 allows attackers to execute a path traversal attack.

An issue in ZipGenius Team ZipGenius v.6.3.2.3116 and before allows a remote attacker to escalate privileges and execute arbitrary code via the zipgenius.exe.

An issue in Franco Corbelli ZPAQFRANZ v.61.3 and before allows a remote attacker to escalate privileges and execute arbitrary code via a bypass of the Mark-of-the-Web protection mechanism.

An issue in Milos Paripovic OneCommander v.3.96.0.0 allows a remote attacker to execute arbitrary code via the OneCommander.exe component.

A vulnerability in CoffeeZip version 4.8.0.0 by OhSoft allows attackers to execute arbitrary code via downloading and executing a crafted archive file.

In ExpressZip v11.29 by NCH Software, a vulnerability allows attackers to execute arbitrary code by downloading and running a crafted archive file.

Question2Answer through version 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access after a password reset, because the forgot-password flow does not clear the sessioncode field.

The MIME header parsing code in Thunderbird when forwarding a message (with the setting to view all headers enabled) has an off-by-one error, allowing a single byte to be read from memory after the header buffer, potentially crashing Thunderbird. Fixed in Thunderbird 153 and Thunderbird 140.13.

In Compass, when importing connections, it is possible to override connection options that normally cannot be changed via the connection form. In particular, a custom browser open command for OIDC auth flow can be provided, which is usually only set globally in Compass settings.

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registers a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process.

A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating malformed BSONColumn data containing a CodeWScope element, bypassing wire-level BSON validation. When the forged element is decompressed, the unchecked size value is used in pointer arithmetic, causing either a server crash or disclosure of adjacent heap memory contents.

When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup.

An authenticated low-privileged user may perform unauthorized reads and writes on data protected by role-based query-level access controls due to insufficient validation of client-supplied command parameters. This affects find, update, delete, and aggregate commands in non-apiStrict configurations.

ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could allow an attacker with valid credentials to bypass MFA.

FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder. An attacker can supply a crafted ADX or AAX audio file with a mid-stream channel layout change, causing the use of a stale channel count and out-of-bounds memory access.

FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer (libavformat/rtpdec_asf.c). The rtp_asf_fix_header function fails to validate a minimum chunksize, allowing a remote attacker to send a crafted RTP/ASF stream causing CPU exhaustion and denial of service.