1312456 matches found
Nextcloud: Persistent SMTP header injection via identity `organization` / `name`
A vulnerability was discovered in the Roundcube webmail client that allowed persistent SMTP header injection through the identity organization and name fields. The vulnerability was caused by insufficient validation of the user-supplied input, which resulted in the unfiltered data being stored an...
curl: Heap use-after-free (write) in mev_forget_socket() via reentrant curl_easy_pause() — incomplete fix for CVE-2026-9080
lib/multiev.c keeps a hash table multi-ev.shentries of per-socket bookkeeping structs struct mevshentry used to decide when to notify the application's socket callback CURLMOPTSOCKETFUNCTION about interest changes on a socket. CVE-2026-9080 "multi: handle pause in multi socket callback", commit...
curl: SMTP CRLF injection in custom SMTP recipient operand allows additional SMTP commands after authentication
Summary During testing of curl 8.18.0, I observed that CRLF characters embedded in the SMTP recipient operand used with a custom SMTP request are transmitted as additional SMTP commands. The injected commands are accepted and processed after successful SMTP authentication, allowing multiple SMTP...
IBM: Unauthorized vertical privilege escalation vulnerability found on ibm.com endpoint
A vertical privilege escalation vulnerability was found on an ibm.com endpoint. The vulnerability was reported to IBM, analyzed, and remediated...
MariaDB: MariaDB: heap buffer overflow in ha_tina::chain_append() lets a low-privileged user crash the server via CSV row deletion
A heap buffer overflow vulnerability was discovered in the hatina::chainappend function of the MariaDB database server. The vulnerability was caused by an incorrect memory allocation during the growth of a data structure. This could allow a low-privileged user to crash the server by executing a...
MariaDB: DROP PACKAGE leaves PACKAGE BODY grant in mysql.procs_priv causing privilege escalation
A privilege escalation vulnerability was discovered in package management functionality. When a package was dropped, the associated grant in the privilege table for the package body was not removed, while the package object itself was deleted from the system catalog. If a new package with the sam...
Weblate: Unauthenticated ?q= search query causes exponential pyparsing backtracking under a process-global lock in Weblate
A vulnerability was discovered in Weblate, an open-source translation management system. The vulnerability was caused by the search query grammar implementation in Weblate, which was built using the pyparsing library. The grammar was ambiguous at every position and did not enable memoization,...
MariaDB: Out-of-bounds read in MariaDB .frm parsing enables RCE via vtable hijacking
A vulnerability was discovered in MariaDB where the keypart-fieldnr value parsed from a crafted .frm file was not validated before being used as an index into the share-field array. This resulted in an out-of-bounds read, allowing an attacker to hijack the C++ virtual method call and achieve...
MariaDB: KILL authorization trusts the presented login name instead of the authenticated anonymous account
A vulnerability was discovered in the KILL authorization process of a database management system. The vulnerability allowed an anonymous account to terminate connections using a supplied login name, even if the authenticated identity was different. This was because the KILL authorization relied o...
MariaDB: Connector/C Out-of-bounds read in `unpack_fields()` from short metadata field
A buffer over-read vulnerability was identified in the metadata field parsing function within the database connector library. The function processed fixed-header metadata without validating that the field data contained the required minimum length of 12 bytes. A malicious or compromised server...
WordPress: Unauthenticated disclosure of draft/private/pending post titles & IDs via Secure Custom Fields nopriv AJAX field-query handlers (post_object/relations
The Secure Custom Fields plugin in version 6.9.2 registered unauthenticated AJAX query handlers for the postobject, relationship, and pagelink field types. These handlers ran a WordPress query with the poststatus parameter set to "any", which returned draft, pending, private, and future posts...
MariaDB: ACL cache collision lets a role inherit privileges from a same-named socket user
A vulnerability was discovered in MariaDB's database privilege cache where a role and a UNIX-socket user with the same name were not distinguished. When the socket user warmed the cache with their privileges, a different account that activated the same-named role then received the cached user...
8x8: @jitsi/docker-jitsi-meet: `/colibri-relay-ws/` unsafe nginx regex (OCTO relay configuration)
An unsafe nginx regex pattern was discovered in the /colibri-relay-ws/ location of the @jitsi/docker-jitsi-meet project. The regex a-zA-Z0-9-\.+ accepted arbitrary domain names and IP addresses for proxypass directives, allowing unauthenticated requests to be proxied to attacker-specified...
Weblate: SSRF via URL Parser Differential in `normalize_request_url` (wlc)
The Weblate CLI client wlc was found to be vulnerable to Server-Side Request Forgery SSRF due to a differential in URL parsing between the urllib and urllib3 libraries. The vulnerability was present in the normalizerequesturl function, which was meant to validate that outgoing API requests stayed...
MariaDB: Privilege escalation via user controlled usernames / roles and views
A privilege escalation vulnerability was discovered in the handling of user-controlled usernames and roles in view and stored procedure definers. Newline characters embedded in usernames or roles were not properly sanitized when saved as raw option strings, allowing users to inject arbitrary...
Liberapay: Unauthenticated team "income/payments" export ignores donor privacy settings (hide_giving, hide_from_lists) and uses frozen visibility, exposing donat
A vulnerability was discovered in the unauthenticated team "income/payments" export feature of Liberapay. The vulnerability allowed an attacker to retrieve donor identity, exact donation amount, and donation dates for public donors, bypassing the donor's explicit privacy settings such as...
MariaDB: MariaDB GRANT PROXY permits unauthorized authentication changes and administrator account takeover
A vulnerability was discovered in MariaDB that allowed an authenticated user with only USAGE privileges to change the password of an existing administrator account. This was achieved through the grantee clause of the GRANT PROXY statement, which permitted bypassing the authorization checks and...
Weblate: Incomplete fix for CVE-2022-23915: Mercurial argument injection in HgRepository.get_file() leads to command execution
A vulnerability was discovered in Weblate, a web-based translation tool. The vulnerability was caused by an incomplete fix for a previous issue CVE-2022-23915. Weblate passed repository-controlled filenames to Mercurial without properly escaping them, allowing filenames beginning with "-" to be...
Essity: Unauthenticated SQL Injection via REST Batch Route Confusion ████████
A vulnerability was discovered in the WordPress REST API batch endpoint /wp-json/batch/v1 on a certain website. The vulnerability allowed unauthenticated blind SQL injection by nesting a crafted batch payload, which triggered a route-dispatch desynchronization. This caused a user-controlled strin...