ImageMagick resource management error vulnerability

Versions of ImageMagick prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability arises because the UHDR decoder performs range checks only after decoding, allowing attackers to bypass image size restrictions and deliver specially crafted ultra-large UHDR images,...

Rclone authorization issue vulnerability

Versions 1.68.0 through 1.75.2 of Rclone contain an authorization issue vulnerability. This vulnerability stems from an authorization bypass in serve s3 --auth-proxy; authenticated tenants can manipulate their multipart uploads by referencing the upload IDs of other tenants. This may result in...

ImageMagick buffer error vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and prior to 7.1.2-33 contain a buffer error vulnerability. This vulnerability arises from a heap buffer overflow occurring during X11 animate operations when processing specially crafted images; it may lead to heap memory corruption and cause the...

YesWiki cross-site scripting vulnerability

Versions 4.2.0 through 4.7.0 of YesWiki contain a cross-site scripting vulnerability stemming from a stored XSS issue. Authenticated users can inject scripts into comment bodies via the wakka raw HTML syntax. Attackers can post comments using the /api/comments endpoint; however, Twig’s raw filter...

OpenRemote core authorization issue vulnerability

Versions of OpenRemote prior to 1.31.0 contain an authorization issue vulnerability. This vulnerability arises because realm or gateway-descendant authorization is not applied to inbound edge gateway events; only a reversible conversion via GatewayConnector.mapAssetId is used to map event asset...

vLLM input validation error vulnerability

Versions vLLM 0.22.0 through 0.24.0 contain an input validation error vulnerability. This flaw stems from Rust’s gRPC frontends failing to properly restrict logprobtokenids. Remote attackers can exploit this by sending a Generate or GenerateStream request that enables outputlogprobs and contains...

vLLM server request forgery vulnerability

Versions prior to vLLM 0.24.0, specifically version 0.9.2, contain a server-side request forgery vulnerability. This vulnerability arises from embedding a decoding address within the X-Request-Id header, enabling server-side request forgery. Attackers can pre-populate the P2pNcclConnector with...

Rotki encryption issue vulnerability

Versions prior to rotki 1.44.2 contain an encryption vulnerability. This vulnerability arises because the premium synchronization key is a single unsalted SHA-256 hash of the user’s password, resulting in weak key derivation. Attackers can brute-force backups and decrypt databases containing...

Rclone path traversal vulnerability

Versions of Rclone prior to 1.75.2 contain a path traversal vulnerability. This vulnerability arises because the serve webdav component fails to validate ‘..’ path components, allowing unauthorized attackers to write files above the service root directory. This may result in creation, overwriting...

Rclone server request forgery vulnerability

Versions 1.37 through 1.74.2 of Rclone contain a server-side request forgery vulnerability. This flaw stems from improper handling of double slashes in the root path by --rc-serve, making it susceptible to server-side request forgery attacks. Unauthenticated attackers can redirect HTTP and...

YesWiki authorization issue vulnerability

Versions 4.6.2 through 4.7.0 of YesWiki contain an authorization issue vulnerability. This vulnerability stems from a lack of authorization checks in ActivityPubService::syncActorPosts. A malicious ActivityPub server can, during an administrator-initiated sync, inject malicious outbox entries tha...

Rclone input validation error vulnerability

Versions of Rclone from 1.52.0 through 1.75.2 contain an input validation error vulnerability. This vulnerability stems from the pCloud backend’s failure to verify the localhost OAuth callback status and trusting the hostname parameter. It makes the system susceptible to cross-site request forger...

ImageMagick resource management error vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and versions prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability stems from memory leaks occurring when various decoders process XMP configuration files. An attacker can supply an image containing a specially crafted...

Firecrawl server request forgery vulnerability

Versions prior to Firecrawl 2.11.586 contain a server-side request forgery vulnerability. This flaw stems from an SSRF proxy within the Playwright service; attackers can exploit it by using DNS rebinding to bypass the isInternalHost check. As a result, when validating requests, they receive publi...

Rclone numeric error vulnerability

Versions of Rclone prior to 1.75.0 and 1.75.2 contain a numerical error vulnerability. This vulnerability arises because an integer overflow in multi-part reordering memory statistics allows bypassing configured buffer limits. Attackers can exploit this by sending two concurrent current-part PUT...

ImageMagick resource management error vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and versions prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability stems from uncontrolled recursion in the MVG decoder, potentially leading to a stack overflow. When an attacker supplies a specially crafted MVG file an...

Krupal Employee Recruitment System input validation error vulnerability

The Krupal Employee Recruitment System has a security vulnerability stemming from improper handling of the pemail parameter in the file /source/registerform3.php within its Registration component. This flaw may lead to SQL injection, allowing attackers to launch remote attacks...

ImageMagick resource management error vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and versions prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability arises because the MSL decoder fails to release allocated memory when processing specially crafted MSL images, potentially leading to memory leaks...

SiYuan encryption issue vulnerability

Versions 3.6.0 through 3.8.7 of SiYuan contain an encryption vulnerability. This flaw arises because networkServeTLS settings are accepted and persisted but never enforced, allowing kernel ports to provide full API access via plain HTTP outside of HTTPS. Compromised attackers on adjacent networks...

ImageMagick resource management error vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability arises from memory allocation used when processing the -cdl color decision list option without subsequent cleanup. An attacker can supply input to trigger this...

ImageMagick resource management error vulnerability

Versions of ImageMagick prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability arises because PerlMagick fails to release returned values when reading image properties, resulting in memory leaks. Attackers can repeatedly trigger this behavior to exhaust memory and...

ImageMagick resource management error vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability arises because the JNG encoder fails to release allocated memory when processing specially crafted images. Attackers can exploit this by providing a specially...

dbcli mycli command injection vulnerability

Versions 2.29.0, 2.29.1, 2.29.2, 2.29.3, 2.29.4, 2.30.0, and 2.30.1 of dbcli mycli contain a command injection vulnerability. This vulnerability stems from an OS command injection flaw in the sourcespecialcommandissafe function within the file mycli/packages/special/source.py in the Whitelist...

KodCloud KodExplorer server request forgery vulnerability

KodCloud KodExplorer versions 4.56 and earlier contain a server-side request forgery vulnerability. This vulnerability stems from an issue in the requesturlsafe function within the app/function/webfunction.php file in the Remote Download component, potentially allowing remote attackers to perform...

SiYuan path traversal vulnerability

Versions prior to SiYuan 3.8.7 contain a path traversal vulnerability. This vulnerability stems from incomplete inclusion of sensitive file paths in the blacklist used by the validateAssetUploadPaths dependency within the MCP asset tool; files such as .env are omitted. As a result, authenticated...

YesWiki cross-site scripting vulnerability

Versions prior to YesWiki 4.7.0 contain a cross-site scripting vulnerability. This flaw arises because filtertags fails to encode output for token values controlled by attackers. Anonymous attackers can exploit this by injecting tags via the action-attribute parameter, thereby bypassing the...

SourceCodester Performance Indicator System input validation error vulnerability

Version 1.0 of the SourceCodester Performance Indicator System contains a security vulnerability stemming from improper handling of the Contact parameter in the file /opils/staff/adddealer.php, which may lead to SQL injection...

ImageMagick resource management error vulnerability

Versions of ImageMagick prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability arises from a lack of cleanup after a magick compare command fails, potentially leading to memory leaks. Attackers can exploit this by providing input that triggers repeated comparison...

vLLM resource management error vulnerability

Versions vLLM from 0.18.0 up to but not including 0.31.0 contain a resource management error vulnerability. This vulnerability arises because the API client can bypass the maximum number of video/JPEG frames by using mediaiokwargs to set numframes to -1 and uploading large inline videos. As a...

vLLM resource management error vulnerability

Versions vLLM from 0.8.5 up to but not including 0.31.0 contain a resource management error vulnerability. This vulnerability arises because LogprobsTensors.emptycpu allocates an uninitialized int32 tensor, and the V1 model runner fails to write the prompt location computed by the KV connector...

SiYuan cross-site scripting vulnerability

Versions 2.9.0 through 3.8.7 of SiYuan contain a cross-site scripting vulnerability. This flaw arises because unauthenticated /check-auth pages assign the to parameter to window.location.href without performing protocol validation, potentially enabling cross-site scripting attacks. Attackers can...

Pig-Mesh Pig input validation error vulnerability

Versions 4.0 and 4.1.0 of Pig Mesh contain a security vulnerability. This vulnerability stems from improper handling of the “ascs” and “descs” parameters in the orderItem.getColumn function within the file...

Grokability Snipe-IT authorization issue vulnerability

Versions of Grokability Snipe-IT prior to 8.6.3 contain an authorization issue vulnerability. This vulnerability stems from GoogleAuthController::handleGoogleCallback failing to enforce a check on the activation flag; as a result, deactivated users may log in via Google SSO and regain their...

YesWiki cross-site request forgery vulnerability

Versions of YesWiki prior to 4.7.0 contain a cross-site request forgery vulnerability. This flaw stems from cross-site request forgery in the despam action tools/security/actions/despam.php. Attackers can insert automatically submitted raw HTML forms into wiki pages, tricking administrators into...

ImageMagick resource management error vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability stems from a lack of cleanup when using the -set profile option, potentially leading to memory leaks, resource exhaustion, and even a denial of service...

ImageMagick cross-site scripting vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and versions prior to 7.1.2-33 contain a cross-site scripting vulnerability. This vulnerability arises because the MVG encoder fails to properly sanitize user-specified drawing options before writing them to the generated MVG output. As a result,...

Rclone path traversal vulnerability

Versions of Rclone prior to 1.75.2 contain a path traversal vulnerability. This vulnerability stems from the translateLink function in the local backend, which after performing inclusion checks, truncates paths containing the .rclonelink suffix. As a result, attackers may resolve names outside th...

DedeCMS input validation error vulnerability

DedeCMS versions 5.7.118 and earlier contain a security vulnerability. This vulnerability stems from improper handling of the vtime parameter in the requireonce function within the file dede/updateguide.php, potentially leading to code injection...

Parse Platform Parse Server permission and access control issue vulnerability

Versions prior to Parse Platform Parse Server 8.6.104 and versions prior to 9.10.5-alpha.5 contain a permission and access control vulnerability. This vulnerability arises because, when generating SMS multi-factor authentication codes, the entire login request is stored with root privileges. User...

Rclone encryption issue vulnerability

Versions of Rclone prior to 1.75.2 contain an encryption vulnerability. This vulnerability arises because the b2 backend leaks real-time account Authorization tokens and SSE-C keys in HTTP redirects originating from the --b2-download-url host, potentially leading to credential leakage...

Leon AI Leon path traversal vulnerability

Leon AI has a path traversal vulnerability. This vulnerability stems from a path traversal issue in the getModelFileNameFromURL function. Attackers can exploit this by sending specially crafted URLs containing the encoded sequence ../, thereby tricking users into running '/download model'. As a...

ImageMagick processing logic error vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and prior to 7.1.2-32 contain a logic error vulnerability stemming from an incomplete fix for policy bypass issues. This allows security policy bypass, enabling attackers to circumvent configuration restrictions that would otherwise prevent certain...

Grokability Snipe-IT authorization issue vulnerability

Versions of Grokability Snipe-IT prior to 8.5.0 contain an authorization issue vulnerability. This flaw stems from the non-atomic nature of nonce checks within the SAML acs handler, potentially enabling SAML assertion replay. Attackers can send concurrent POST requests to /saml/acs to reuse...

vLLM resource management error vulnerability

Versions vLLM 0.10.2 through 0.25.0 contain a resource management error vulnerability. This vulnerability arises because the Nemotron-VL processor sets the global variable Image.MAXIMAGEPIXELS to None. Unauthenticated attackers can exploit this by submitting specially crafted decompression bomb...

YesWiki server request forgery vulnerability

Versions prior to YesWiki 4.7.0 contain a server-side request forgery vulnerability. This vulnerability arises from unauthenticated server-side request forgery, allowing attackers to pass |URL wiki syntax to the render handler. By passing this syntax via the content parameter of the page’s render...

Sh3 encryption issue vulnerability

The sh3 encryption issue involves insufficient strength in password hash calculations within the Módulo de Gestão/Módulo de Arrecadação components. This vulnerability may allow remote exploitation by attackers, though it is relatively difficult to exploit...

ProjectSend authorization issue vulnerability

Versions 2.0.0 through 2.7.1 of ProjectSend contain an authorization issue vulnerability. This vulnerability stems from incomplete authorization checks in FileVersions::link. Staff users can share files by linking to unauthorized file versions. Attackers can also link files to intermediate revisi...

Parse Platform Parse Server authorization issue vulnerability

Versions prior to 8.6.102 and versions 9.0.0 through 9.10.5-alpha.2 of the Parse Platform’s Parse Server contain an authorization issue vulnerability. This vulnerability arises because the validateSetUp, validateLogin, and validateUpdate methods inherited from AuthAdapter are not invoked via cust...

ImageMagick numeric error vulnerability

Versions of ImageMagick prior to 7.1.2-33 contain a numerical error vulnerability. This vulnerability stems from a heap buffer overflow when requesting convex hull information on 32-bit systems. An attacker can supply specially crafted images processed via convex hull computation, thereby...

Rclone information disclosure vulnerability

Versions of Rclone from 1.64.0 up to but including 1.75.2 contain an information disclosure vulnerability. This vulnerability stems from an authentication bypass in the serve webdav component; unauthenticated attackers can send OPTIONS requests to bypass authentication, then probe arbitrary paths...