tox-dev filelock: Processing logic error vulnerability

The tox-dev filelock version 4.1.0 to 4.2.1 contained a processing logic vulnerability. This vulnerability stemmed from the SoftFileLock component reusing outdated observation results when at least two lock user processes were waiting. An attacker could set and delete their own markers, and use...

tox-dev filelock: race condition issue

The tox-dev filelock version 4.1.0 to 4.2.1 had a race condition issue. This issue stemmed from the SoftReadWriteLock and AsyncSoftReadWriteLock classes’ caching mechanism for checking the .rw lock tree successfully, and then re-reshaping its name during subsequent recording operations. This coul...

tox-dev filelock: Permissions, permission grants, and access control issues

The tox-dev filelock version 3.30.0 to 4.2.1 had vulnerabilities related to permission handling and access control. These vulnerabilities stemmed from the use of StrictSoftFileLock version 3.30.0 and later, as well as SoftReadWriteLock version 4.0.0 and later. These versions may use a protocol...

Apostrophe Technologies ApostropheCMS Cross-site Scripting Vulnerability

Apostrophe Technologies' ApostropheCMS has a cross-site scripting vulnerability. This vulnerability arises from the non-default nonTextTags configuration of sanitize-html, which includes noscript. When noscript is present, htmlparser2 causes an implicit ancestor closure within noscript, resulting...

DrayTek Vigor2960: Input validation error vulnerability

The DrayTek Vigor2960 1.5.1.6 revision 8218 version has a security vulnerability. This vulnerability stems from the operation of the settable function in the /cgi-bin/mainfunction.cgi file of the CGI Process component, which may lead to remote command injection...

Optimal IdM OptimalCloud: Input validation error vulnerability

The Optimal IdM OptimalCloud 5.0 version has a vulnerability related to input validation errors. This vulnerability stems from improper handling of the state parameter in the file/v5.0/social, which may lead to open redirection. Attackers can trigger this remotely...

Finsys Dockhand authorization issue vulnerability

Finsys Dockhand versions prior to 1.0.46 have an authorization vulnerability. This vulnerability arises because non-administrator users with the stacks:edit permission can use the /api/system/files/content path parameter to provide absolute paths for file reading, potentially leading to the...

OpenCATS Authorization Issue Vulnerability

Versions of OpenCATS prior to 0.10.0 have an authorization issue. This vulnerability stems from the absence of authorization checks in the ajax/deleteActivity.php and ajax/editActivity.php files. Authorized READ-level users can use GET or POST requests to provide any activity ID, allowing them to...

OpenCATS Authorization Issue Vulnerability

Versions of OpenCATS prior to 0.10.0 have a vulnerability related to authorization. This vulnerability stems from the lack of authorization verification in the ajax/testEmailSettings.php file. Users with read permissions can send test emails to any recipient by providing the parameters...

TYPO3 Fluid-Form: Cross-site scripting vulnerability due to coding.ms

TYPO3 Fluid-Form: Versions from 6.0.0 to 6.0.6 and 5.0.10 and earlier have a cross-site scripting vulnerability. This vulnerability arises due to values entered by visitors being placed in HTML digest emails without being escaped properly, allowing unauthenticated attackers to inject HTML into...

Vite launch-editor command injection vulnerability

Vite launch-editor has a command injection vulnerability. This vulnerability arises when an attacker can create file system entries in the working directory that start with a plus sign or minus sign. In such cases, launch-editor does not enforce the path as a positional file name. As a result, th...

Nokia 1830 Global Express security vulnerabilities

The Nokia 1830 Global Express G42, GX G31, GX G32, and GX G34 models prior to the GX r9.0 version have security vulnerabilities. These vulnerabilities stem from issues with local privilege escalation in the management shell interface. Local attackers who are authenticated and have restricted shel...

Nokia 1830 Global Express security vulnerabilities

The Nokia 1830 Global Express G42, GX G31, GX G32, and GX G34 models prior to the GX r9.0 version have security vulnerabilities. These vulnerabilities stem from bypassing CLI ACLs. Low-privilege authenticated attackers can circumvent the SSH isolation mechanism through custom SSH commands, thereb...

Mozilla Firefox: Vulnerability Due to Improper Exception Handling

Mozilla Firefox has a vulnerability related to improper exception handling. This vulnerability stems from an issue with the Audio/Video: cubeb component, where uninitialized memory is present, which may lead to information leakage...

SolarWinds Observability Self-Hosted Cross-Site Script Vulnerability

SolarWinds Observability Self-Hosted versions 2026.2.3 and earlier have a cross-site scripting vulnerability. This vulnerability stems from a storage-based cross-site scripting flaw. Authorized attackers can inject malicious content or JavaScript, causing other authorized users to display or...

Apache Airflow Amazon provider cross-site request forgeing vulnerability

Apache Airflow’s Amazon provider versions prior to 9.38.0 have a cross-site request forgery vulnerability. This vulnerability stems from the SAML login process of the AWS auth manager, which does not bind the authentication response to the browser that initiated the login. The login processor...

OpenCATS Authorization Issue Vulnerability

Versions of OpenCATS prior to 0.10.0 have an authorization issue vulnerability. This vulnerability stems from the lack of authorization checks. Users with READ privileges can create, rename, delete, and populate save lists through AJAX endpoints. Authorized attackers can send requests with...

DrayTek Vigor2960: Input validation error vulnerability

DrayTek Vigor2960 1.5.1.6 Revision 8218 has a security vulnerability. This vulnerability stems from the incorrect handling of parameters in the option field of the ruequestcertificate function in the /cgi-bin/mainfunction.cgi file within the IPsec Handler component. This could lead to remote...

DrayTek Vigor2960 path traversal vulnerability

DrayTek Vigor2960 1.5.1.6 Revision 8218 has a path traversal vulnerability. This vulnerability stems from the handling of the 'action' parameter in the '/cgi-bin/mainfunction.cgi' file within component Apmupload, allowing for path traversal attacks. Attackers can exploit this vulnerability remote...

Ellucian Banner Student Registration Self-Service Cross-site Scripting Vulnerability

The Ellucian Banner Student Registration Self-Service versions prior to 9.23 contain a cross-site scripting vulnerability. This vulnerability stems from the mepCode parameter in the /ssb/registration endpoint, which contains cross-site scripting. This could allow remote attackers to execute...

Apache Camel server-side request forge vulnerability

Versions of Apache Camel prior to 4.18.5, specifically 4.0.0 and 4.22.1 prior to 4.19.0, have a server-side request forge vulnerability. This vulnerability stems from the camel-as2 component extracting the asynchronous MDN return address from inbound messages and using it directly as the outbound...

IBM MQ Operator buffer error vulnerability

IBM MQ Operator versions 2.0.0 through 2.0.29, 3.2.0 through 3.2.29, 3.3.0 through 3.4.0 excluding versions prior to 3.4.1, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, 3.6.0 through 3.6.4, 3.7.0 through 3.7.2, 3.8.0, 3.8.1, 3.9.0, 3.9.1, 3.9.2, 4.0.0, 4.0.1, 4.0.2, 4.0.3, and 4.0.4 have a buffer error...

Aaron Pettengill: Vulnerability in input validation

Aaron Pettengill’s RVF 7.0.4 and earlier versions have a vulnerability in input validation. This vulnerability stems from prototype pollution in the setPath function, allowing unauthenticated attackers to override properties of shared built-in functions by leveraging the inherited Object.prototyp...

IBM MQ Operator path traversal vulnerability

IBM MQ Operator versions 2.0.0 through 2.0.29, 3.2.0 through 3.2.29, 3.3.0 through 3.4.0 excluding versions prior to 3.4.1, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, 3.6.0 through 3.6.4, 3.7.0 through 3.7.2, 3.8.0, 3.8.1, 3.9.0, 3.9.1, 3.9.2, 4.0.0, 4.0.1, 4.0.2, 4.0.3, and 4.0.4 have a path traversal...

Webkul Aureus ERP information leakage vulnerability

Webkul Aureus ERP versions 1.6.0 and earlier have security vulnerabilities. These vulnerabilities stem from handling of the composer.json file, which allows sensitive information to be inserted into debugging code, potentially leading to information leakage...

IBM Cloud Pak System Cross-site Scripting Vulnerability

IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 have a cross-site scripting vulnerability. This vulnerability stems from an exposure to HTML injection attacks, allowing remote authenticated attackers to inject malicious HTML code. When this code is viewed, it will execute in the victim’s web...

Sunkaifei FlyCms input validation error vulnerability

Sunkaifei FlyCms has a vulnerability in input validation. This vulnerability stems from the batch assignment issue in the /ucenter/accountupdate interface. It allows authenticated users to submit additional User Bean fields to override protected account columns. This may result in changes such as...

IBM MQ deserialization injection vulnerability

IBM MQ has a deserialization injection vulnerability. This vulnerability arises from authenticated attackers sending specially crafted asynchronous consumption requests, which can cause the queue manager proxy process to crash, potentially leading to a denial-of-service attack...

BoxyHQ Enterprise SaaS Starter Kit Authorization Issues Vulnerability

BoxyHQ Enterprise SaaS Starter Kit versions 1.6.0 and earlier have an authorization issue vulnerability. This vulnerability arises from the payment routing process skipping the teampayments permission check, resulting in a lack of authorization. Certified MEMBER or ADMIN users can use functions...

sgl-project SGLang Resource Management Error Vulnerability

The SGLang version 0.5.22 and earlier have a resource management vulnerability. This vulnerability stems from the Mooncake disaggregation backend accepting unvalidated decoding registration messages on the Prefill rank ZMQ PULL socket. An attacker with network proximity can send a large number of...

HankCS HanLP: Input validation error vulnerability

The HankCS HanLP 2.1.0-beta.64 and earlier versions have a security vulnerability. This vulnerability stems from the operation of the loadword2vecasvocabtensor function in the hanlp/utils/torchutil.py file, which involves handling the vectors.vocab parameter, leading to deserialization attacks...

HankCS HanLP: Input validation error vulnerability

The hankcs hanlp 2.1.0-beta.64 and earlier versions have a security vulnerability. This vulnerability stems from the improper handling of the classpath parameter in the hanlp.load function within the Model Config Loading component’s plugins/hanlpcommon/hanlpcommon/reflection.py file. This allows...

Apache Camel input validation vulnerability

Versions of Apache Camel from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a vulnerability related to input validation errors. This vulnerability arises due to XPathBuilder bypassing the default document type when documentType is set to InputSource. As a result, XML external entity reference...

aio-libs Async HTTP client/server framework: Input validation error vulnerability

The aio-libs Async HTTP client/server framework versions prior to 3.14.4 have a vulnerability related to input validation errors. This vulnerability stems from the use of a pure Python parser that accepts ambiguous HTTP request frames. This could allow unvalidated attackers to inject HTTP request...

aio-libs Async HTTP client/server framework Resource management error vulnerability

The aio-libs Async HTTP client/server framework, versions 2.0.0 to 3.14.4, has a resource management vulnerability. This vulnerability stems from the handling of multipart requests, which retains an unlimited number of open file descriptors. When the processing program uses Request.post,...

aio-libs Async HTTP client/server framework: Input validation error vulnerability

The aio-libs Async HTTP client/server framework versions prior to 3.14.4 have a vulnerability related to input validation errors. This vulnerability arises when an attacker can send an absolute-form request, causing Request.scheme to use the request-target scheme data controlled by the attacker...

aio-libs Async HTTP client/server framework – Session mechanism-related vulnerabilities

The aio-libs Async HTTP client/server framework versions prior to 3.14.4 have a session mechanism vulnerability. This vulnerability stems from the Host-Only scope, which allows the removal of cookies from the parent domain. Accessing untrusted subdomains may result in the Host-Only protection of...

Pillow buffer error vulnerability

Versions of Pillow prior to 13.0.0 have a buffer error vulnerability. This vulnerability stems from the JPEG decoder not verifying the actual output width and number of components of libjpeg after requesting scaling. As a result, full-width scanning lines are written into the buffer allocated for...

Zephyr buffer error vulnerability

Zephyr versions 3.4.0 to 4.4.2 have a buffer error vulnerability. This vulnerability stems from the user-mode system call verifier zvrfyrtiocqegetmempoolbuffer in subsys/rtio/rtiosyscalls.c. This verifier uses KSYSCALLMEMORYREAD instead of KSYSCALLMEMORYWRITE to validate the output parameters buf...

Pillow buffer error vulnerability

Pillow versions from 8.1.0 to 13.0.0 contain a buffer error vulnerability. This vulnerability arises due to inconsistencies in the interpretation of identical tags such as PhotometricInterpretation or BitsPerSample during TIFF tile and RGBA decoding processes. Pillow and libtiff do not verify...

Pillow improper exception handling vulnerabilities

Pillow versions prior to 13.0.0 have a vulnerability in exception handling. This vulnerability arises from rank-based filters, which may dereference invalid image memory when processing zero-size images, potentially leading to crashes of the native process...

Pillow buffer error vulnerability

Pillow versions from 8.2.0 to 13.0.0 contain a buffer error vulnerability. This vulnerability stems from the tiled-TIFF decoder, which reads beyond the bounds of the tile buffer when copying four-byte pixels. In decodeTile, the tile allocation returned by libtiff is less than the required row...

Pillow buffer error vulnerability

Versions of Pillow prior to 13.0.0 have a buffer error vulnerability. This vulnerability arises from the ImageMorph.MorphOp.apply function, which processes zero-width images. When PPM and PGM inputs create images with a width of zero, the native morphological routine index outrowwidth - 1 does no...

Pillow improper exception handling vulnerabilities

Pillow versions from 9.1.0 to 13.0.0 have a vulnerability related to improper exception handling. This vulnerability arises when the ImagingPaletteCacheUpdate function is used with an air-conditioned palette, and the local cache array is not initialized. As a result, the conversion path uses...

Apache Camel information leakage vulnerability

Apache Camel HTTP versions from 4.0.0 to 4.18.5, as well as versions from 4.19.0 to 4.22.1, have a vulnerability related to information leakage. This vulnerability arises when the followRedirects=true parameter is used, and the OAuth2ClientConfigurer interceptor intercepts and matches AuthScope f...

IBM MQ numerical error vulnerability

IBM MQ has a numerical error vulnerability. This vulnerability stems from a buffer overflow issue when processing specially crafted object names, which may allow authenticated attackers to cause process instability...

WordPress FluentCommunity authorization issue vulnerability

WordPress FluentCommunity versions 2.11.0 and earlier have a permission-related vulnerability. This vulnerability stems from the lack of proper authorization, which may allow attackers to exploit improperly configured access control levels...

DeepPavlov Team: Vulnerability in input validation

The DeepPavlov team has identified a security vulnerability in versions 1.7.0 and earlier of DeepPavlov. This vulnerability stems from improper handling of the resolve function in the Config Reference Resolver component’s deeppavlov/core/common/params.py file, which may lead to remote code...

MLJAR Mercury authorization issue vulnerability

The MLJAR mercury version prior to 3.2.6 has an authorization issue vulnerability. This vulnerability stems from the default lack of token deployment, allowing anonymous clients to create Jupyter kernels and send executerequest messages containing arbitrary Python code. Additionally, the endpoint...

LlamaFamily: Llama Chinese Community: Input validation error vulnerability

The LlamaFamily Llama Chinese community has a security vulnerability. This vulnerability stems from an error in the function getclassfromdynamicmodule in the Adapter Config component’s examples/chatgradionomerge.py file, where the parameter basemodelnameorpath is handled incorrectly, potentially...