ImageMagick resource management error vulnerability

Versions of ImageMagick prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability arises because the UHDR decoder performs range checks only after decoding, allowing attackers to bypass image size restrictions and deliver specially crafted ultra-large UHDR images,...

ImageMagick buffer error vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and prior to 7.1.2-33 contain a buffer error vulnerability. This vulnerability arises from a heap buffer overflow occurring during X11 animate operations when processing specially crafted images; it may lead to heap memory corruption and cause the...

YesWiki cross-site scripting vulnerability

Versions 4.2.0 through 4.7.0 of YesWiki contain a cross-site scripting vulnerability stemming from a stored XSS issue. Authenticated users can inject scripts into comment bodies via the wakka raw HTML syntax. Attackers can post comments using the /api/comments endpoint; however, Twig’s raw filter...

vLLM input validation error vulnerability

Versions vLLM 0.22.0 through 0.24.0 contain an input validation error vulnerability. This flaw stems from Rust’s gRPC frontends failing to properly restrict logprobtokenids. Remote attackers can exploit this by sending a Generate or GenerateStream request that enables outputlogprobs and contains...

Rclone path traversal vulnerability

Versions of Rclone prior to 1.75.2 contain a path traversal vulnerability. This vulnerability arises because the serve webdav component fails to validate ‘..’ path components, allowing unauthorized attackers to write files above the service root directory. This may result in creation, overwriting...

Rclone numeric error vulnerability

Versions of Rclone prior to 1.75.0 and 1.75.2 contain a numerical error vulnerability. This vulnerability arises because an integer overflow in multi-part reordering memory statistics allows bypassing configured buffer limits. Attackers can exploit this by sending two concurrent current-part PUT...

Rclone authorization issue vulnerability

Versions 1.68.0 through 1.75.2 of Rclone contain an authorization issue vulnerability. This vulnerability stems from an authorization bypass in serve s3 --auth-proxy; authenticated tenants can manipulate their multipart uploads by referencing the upload IDs of other tenants. This may result in...

ImageMagick resource management error vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and versions prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability stems from uncontrolled recursion in the MVG decoder, potentially leading to a stack overflow. When an attacker supplies a specially crafted MVG file an...

Rclone path traversal vulnerability

Versions of Rclone prior to 1.75.2 contain a path traversal vulnerability. This vulnerability stems from the translateLink function in the local backend, which after performing inclusion checks, truncates paths containing the .rclonelink suffix. As a result, attackers may resolve names outside th...

Rclone information disclosure vulnerability

Versions of Rclone from 1.56.0 through 1.75.2 contain an information disclosure vulnerability. This vulnerability arises because the WebDAV backend forwards custom credentials configured by the operator via HTTP 3xx redirects to different hosts. Attackers can control or influence these cross-host...

Rclone input validation error vulnerability

Versions of Rclone from 1.52.0 through 1.75.2 contain an input validation error vulnerability. This vulnerability stems from the pCloud backend’s failure to verify the localhost OAuth callback status and trusting the hostname parameter. It makes the system susceptible to cross-site request forger...

Rclone information disclosure vulnerability

Versions of Rclone from 1.64.0 up to but including 1.75.2 contain an information disclosure vulnerability. This vulnerability stems from an authentication bypass in the serve webdav component; unauthenticated attackers can send OPTIONS requests to bypass authentication, then probe arbitrary paths...

Rclone server request forgery vulnerability

Versions 1.37 through 1.74.2 of Rclone contain a server-side request forgery vulnerability. This flaw stems from improper handling of double slashes in the root path by --rc-serve, making it susceptible to server-side request forgery attacks. Unauthenticated attackers can redirect HTTP and...

Dokploy authorization issue vulnerability

Versions 0.30.10 and earlier of Dokploy contain an authorization issue vulnerability. This vulnerability stems from authorization bypass, allowing any organization owner or administrator to control other tenants’ applications by providing an external applicationId value. This enables them to invo...

vLLM input validation error vulnerability

Versions vLLM 0.20.1 through 0.29.0 contain an input validation error vulnerability. This flaw stems from improper validation of stoptokenids. Remote attackers can exploit it by sending OpenAI chat, completion, generate, or batch requests containing invalid IDs, potentially causing the engine to...

Improper ImageMagick exception handling vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and prior to 7.1.2-33 contain an improper exception handling vulnerability. This vulnerability arises because the DJVU decoder fails to validate memory allocation results; as a result, attackers can supply specially crafted DJVU images that cause the...

SiYuan path traversal vulnerability

Versions prior to SiYuan 3.8.7 contain a path traversal vulnerability. This vulnerability stems from incomplete inclusion of sensitive file paths in the blacklist used by the validateAssetUploadPaths dependency within the MCP asset tool; files such as .env are omitted. As a result, authenticated...

Rotki encryption issue vulnerability

Versions prior to rotki 1.44.2 contain an encryption vulnerability. This vulnerability arises because the premium synchronization key is a single unsalted SHA-256 hash of the user’s password, resulting in weak key derivation. Attackers can brute-force backups and decrypt databases containing...

YesWiki authorization issue vulnerability

Versions 4.6.2 through 4.7.0 of YesWiki contain an authorization issue vulnerability. This vulnerability stems from a lack of authorization checks in ActivityPubService::syncActorPosts. A malicious ActivityPub server can, during an administrator-initiated sync, inject malicious outbox entries tha...

ImageMagick resource management error vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and versions prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability stems from memory leaks occurring when various decoders process XMP configuration files. An attacker can supply an image containing a specially crafted...

Firecrawl server request forgery vulnerability

Versions prior to Firecrawl 2.11.586 contain a server-side request forgery vulnerability. This flaw stems from an SSRF proxy within the Playwright service; attackers can exploit it by using DNS rebinding to bypass the isInternalHost check. As a result, when validating requests, they receive publi...

Krupal Employee Recruitment System input validation error vulnerability

The Krupal Employee Recruitment System has a security vulnerability stemming from improper handling of the pemail parameter in the file /source/registerform3.php within its Registration component. This flaw may lead to SQL injection, allowing attackers to launch remote attacks...

ImageMagick resource management error vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and versions prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability arises because the MSL decoder fails to release allocated memory when processing specially crafted MSL images, potentially leading to memory leaks...

ImageMagick resource management error vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability arises from memory allocation used when processing the -cdl color decision list option without subsequent cleanup. An attacker can supply input to trigger this...

ImageMagick resource management error vulnerability

Versions of ImageMagick prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability arises because PerlMagick fails to release returned values when reading image properties, resulting in memory leaks. Attackers can repeatedly trigger this behavior to exhaust memory and...

ImageMagick resource management error vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability arises because the JNG encoder fails to release allocated memory when processing specially crafted images. Attackers can exploit this by providing a specially...

dbcli mycli command injection vulnerability

Versions 2.29.0, 2.29.1, 2.29.2, 2.29.3, 2.29.4, 2.30.0, and 2.30.1 of dbcli mycli contain a command injection vulnerability. This vulnerability stems from an OS command injection flaw in the sourcespecialcommandissafe function within the file mycli/packages/special/source.py in the Whitelist...

KodCloud KodExplorer server request forgery vulnerability

KodCloud KodExplorer versions 4.56 and earlier contain a server-side request forgery vulnerability. This vulnerability stems from an issue in the requesturlsafe function within the app/function/webfunction.php file in the Remote Download component, potentially allowing remote attackers to perform...

YesWiki cross-site scripting vulnerability

Versions prior to YesWiki 4.7.0 contain a cross-site scripting vulnerability. This flaw arises because filtertags fails to encode output for token values controlled by attackers. Anonymous attackers can exploit this by injecting tags via the action-attribute parameter, thereby bypassing the...

SourceCodester Performance Indicator System input validation error vulnerability

Version 1.0 of the SourceCodester Performance Indicator System contains a security vulnerability stemming from improper handling of the Contact parameter in the file /opils/staff/adddealer.php, which may lead to SQL injection...

ImageMagick resource management error vulnerability

Versions of ImageMagick prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability arises from a lack of cleanup after a magick compare command fails, potentially leading to memory leaks. Attackers can exploit this by providing input that triggers repeated comparison...

vLLM resource management error vulnerability

Versions vLLM from 0.8.5 up to but not including 0.31.0 contain a resource management error vulnerability. This vulnerability arises because LogprobsTensors.emptycpu allocates an uninitialized int32 tensor, and the V1 model runner fails to write the prompt location computed by the KV connector...

SiYuan cross-site scripting vulnerability

Versions 2.9.0 through 3.8.7 of SiYuan contain a cross-site scripting vulnerability. This flaw arises because unauthenticated /check-auth pages assign the to parameter to window.location.href without performing protocol validation, potentially enabling cross-site scripting attacks. Attackers can...

Pig-Mesh Pig input validation error vulnerability

Versions 4.0 and 4.1.0 of Pig Mesh contain a security vulnerability. This vulnerability stems from improper handling of the “ascs” and “descs” parameters in the orderItem.getColumn function within the file...

Grokability Snipe-IT authorization issue vulnerability

Versions of Grokability Snipe-IT prior to 8.6.3 contain an authorization issue vulnerability. This vulnerability stems from GoogleAuthController::handleGoogleCallback failing to enforce a check on the activation flag; as a result, deactivated users may log in via Google SSO and regain their...

YesWiki cross-site request forgery vulnerability

Versions of YesWiki prior to 4.7.0 contain a cross-site request forgery vulnerability. This flaw stems from cross-site request forgery in the despam action tools/security/actions/despam.php. Attackers can insert automatically submitted raw HTML forms into wiki pages, tricking administrators into...

Krupal Employee Recruitment System input validation error vulnerability

The Krupal Employee Recruitment System has a security vulnerability. This vulnerability stems from improper handling of the parameters firstname, middlename, lastname, gender, birthdate, state, statespecify, city, and cityspecify by the mysqlquery function within the Registration component at...

ImageMagick cross-site scripting vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and versions prior to 7.1.2-33 contain a cross-site scripting vulnerability. This vulnerability arises because the MVG encoder fails to properly sanitize user-specified drawing options before writing them to the generated MVG output. As a result,...

Parse Platform Parse Server permission and access control issue vulnerability

Versions prior to Parse Platform Parse Server 8.6.104 and versions prior to 9.10.5-alpha.5 contain a permission and access control vulnerability. This vulnerability arises because, when generating SMS multi-factor authentication codes, the entire login request is stored with root privileges. User...

Leon AI Leon path traversal vulnerability

Leon AI has a path traversal vulnerability. This vulnerability stems from a path traversal issue in the getModelFileNameFromURL function. Attackers can exploit this by sending specially crafted URLs containing the encoded sequence ../, thereby tricking users into running '/download model'. As a...

ImageMagick processing logic error vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and prior to 7.1.2-32 contain a logic error vulnerability stemming from an incomplete fix for policy bypass issues. This allows security policy bypass, enabling attackers to circumvent configuration restrictions that would otherwise prevent certain...

vLLM resource management error vulnerability

Versions vLLM 0.10.2 through 0.25.0 contain a resource management error vulnerability. This vulnerability arises because the Nemotron-VL processor sets the global variable Image.MAXIMAGEPIXELS to None. Unauthenticated attackers can exploit this by submitting specially crafted decompression bomb...

YesWiki server request forgery vulnerability

Versions prior to YesWiki 4.7.0 contain a server-side request forgery vulnerability. This vulnerability arises from unauthenticated server-side request forgery, allowing attackers to pass |URL wiki syntax to the render handler. By passing this syntax via the content parameter of the page’s render...

Sh3 encryption issue vulnerability

The sh3 encryption issue involves insufficient strength in password hash calculations within the Módulo de Gestão/Módulo de Arrecadação components. This vulnerability may allow remote exploitation by attackers, though it is relatively difficult to exploit...

ProjectSend authorization issue vulnerability

Versions 2.0.0 through 2.7.1 of ProjectSend contain an authorization issue vulnerability. This vulnerability stems from incomplete authorization checks in FileVersions::link. Staff users can share files by linking to unauthorized file versions. Attackers can also link files to intermediate revisi...

ImageMagick numeric error vulnerability

Versions of ImageMagick prior to 7.1.2-33 contain a numerical error vulnerability. This vulnerability stems from a heap buffer overflow when requesting convex hull information on 32-bit systems. An attacker can supply specially crafted images processed via convex hull computation, thereby...

Parse Platform Parse Server information disclosure vulnerability

Versions prior to Parse Platform Parse Server 8.6.103 and versions from 9.0.0 through 9.10.5-alpha.4 contain an information disclosure vulnerability. This vulnerability arises because LiveQuery’s subscription hash fails to respect constraints surrounding the $or operator, including the Session...

KodCloud KodExplorer permission and access control issue vulnerability

KodCloud KodExplorer versions 4.55 and earlier contain a security vulnerability. This vulnerability stems from improper handling of the ‘path’ parameter in the file app/controller/editor.class.php within the Online Editor Save Endpoint component. As a result, unrestricted file uploads are possibl...

SourceCodester Performance Indicator System input validation error vulnerability

Version 1.0 of the SourceCodester Performance Indicator System contains a security vulnerability stemming from improper handling of the Contact parameter in the file /opils/staff/editdealer.php, which may lead to SQL injection...

YesWiki SQL injection vulnerability

Versions prior to 4.7.0 of YesWiki contain an SQL injection vulnerability. This flaw arises because the datemajfiche field in Bazar entry creation requests within PageManager::save is concatenated into the INSERT statement without proper escaping. As a result, it is susceptible to SQL injection...