CVE Vulnerability Catalog

The SDL_image library before commit 996bf12888925932daace576e09c3053410896f8 has a heap out-of-bounds read vulnerability in do_layer_surface() in src/IMG_xcf.c. Pixel indices from XCF files are used without validation against colormap size, allowing reads up to 762 bytes past the allocation, with leaked data potentially visible in the rendered image.

In Directus prior to 11.17.0, aggregate functions on conceal fields return raw values instead of masked placeholders. Authenticated users with read access can extract concealed values including API tokens and 2FA secrets.

Directus prior to 11.16.1 has a vulnerability in the TUS resumable upload endpoint (/files/tus) that allows an authenticated user with basic file upload permissions to overwrite arbitrary existing files by UUID. The TUS controller performs only collection-level authorization, bypassing row-level access rules.

In Directus prior to 11.16.0, an SSRF protection bypass was found using IPv4-Mapped IPv6 address notation, allowing requests to local and private networks.

In Directus prior to 11.17.0, the SSO login pages lack the Cross-Origin-Opener-Policy (COOP) header. An attacker can intercept and redirect the OAuth authorization flow to a controlled OAuth client, stealing access to the victim's account.

WeGIA (Web manager for charitable institutions) versions prior to 3.6.9 contain a SQL injection vulnerability in dao/memorando/DespachoDAO.php. The id_memorando parameter is extracted from $_REQUEST without validation and directly interpolated into SQL queries, allowing any authenticated user to execute arbitrary SQL commands against the database. This vulnerability is fixed in version 3.6.9.

Mobile Next (mobile-mcp) versions prior to 0.0.50 have a vulnerability in the mobile_open_url tool that passes user-supplied URLs directly to Android's intent system without any scheme validation, allowing execution of arbitrary Android intents, including USSD codes, phone calls, SMS messages, and content provider access. This vulnerability is fixed in version 0.0.50.

In Bulwark Webmail before 1.4.11, the getClientIP() function trusts the first (leftmost) entry of the X-Forwarded-For header, which is fully controlled by the client. An attacker can forge their source IP to bypass IP-based rate limiting (enabling brute-force attacks on the admin login) or forge audit log entries.

In Bulwark Webmail prior to 1.4.11, S/MIME signature verification did not validate the certificate trust chain, so any email signed with a self-signed or untrusted certificate was displayed as having a valid signature.

The @hapi/content library through version 6.0.0 is vulnerable to Regular Expression Denial of Service (ReDoS) via crafted HTTP header values. Three regular expressions used to parse Content-Type and Content-Disposition headers contain patterns susceptible to catastrophic backtracking.

A synchronization issue in the Wi-Fi driver of Samsung Exynos and Wearable processors leads to a double-free vulnerability. An attacker can trigger a race condition by concurrently invoking the ioctl function from multiple threads.

ZLMediaKit, a streaming media service framework, has a heap buffer overflow vulnerability in the VP9 RTP payload parser in ext-codec/VP9Rtp.cpp. Lack of data length validation before reading can lead to out-of-bounds read.

In pyLoad 0.5.0b3.dev96 and earlier, the parse_urls API function fetches arbitrary URLs server-side without validation. An authenticated user with ADD permission can read internal resources, local files (file://), and use gopher:// and dict:// protocols.

HAX CMS prior to version 25.0.0 publicly exposes the /server-status endpoint, which reveals sensitive information including authentication tokens (user_token), user activity, client IP addresses, and server configuration details. Any unauthenticated user can monitor real-time user interactions and gather internal infrastructure information.

An IDOR vulnerability in the article image deletion feature in Brave CMS prior to 2.0.6. The deleteImage method in ArticleController.php accepts a filename from the URL without ownership verification, allowing an authenticated user with edit permissions to delete images attached to other users' articles.

In Brave CMS prior to 2.0.6, the update role endpoint lacks authorization checks, allowing any authenticated user to change roles and become Super Admin.

In openFPGALoader version 1.1.1 and earlier, a heap-buffer-overflow read vulnerability exists in POFParser::parseSection() that allows out-of-bounds heap memory access when parsing a crafted .pof file. No FPGA hardware is required to trigger this vulnerability.

In Distribution (a container packaging and distribution toolkit) prior to version 3.1.0, when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled, deleting a blob from repo a does not fully clear the Redis cache entries. After a later read from repo b, the deleted blob becomes readable again in repo a.

In openFPGALoader version 1.1.1 and earlier, a heap-buffer-overflow read vulnerability exists in BitParser::parseHeader() that allows out-of-bounds heap memory access when parsing a crafted .bit file. No FPGA hardware is required to trigger this vulnerability.

A lack of input validation in Samsung Exynos processors and modems leads to a Denial of Service (DoS).