Red Hat Keycloak authorization issue vulnerability

Red Hat Keycloak has an authorization issue vulnerability. This vulnerability arises because the SAML identity proxy component fails to verify whether a user actually possesses a private key associated with a holder-of-key assertion. Attackers can intercept and replay the victim’s signed...

SuiteCRM SQL injection vulnerability

SQL injection vulnerabilities exist in SuiteCRM versions prior to 7.15.2 and from 8.0.0 up to 8.10.2. These vulnerabilities arise because the actiongetkbarticles method in CasesController inserts the search parameter into the CASE WHEN ... LIKE expression and WHERE clause within SQL queries. Inpu...

Red Hat Keycloak input validation error vulnerability

Red Hat Keycloak has an input validation error vulnerability. This vulnerability stems from flaws in the validation process for registration requests within its dynamic client registration functionality. Attackers can map their own user profiles to protected user ID sub or intended audience aud...

Chevereto authorization issue vulnerability

Versions prior to Chevereto 4.5.8 contain an authorization issue vulnerability. This vulnerability stems from an authorization bypass in the get-album-contents action of the /json route. Unauthenticated attackers can list private albums by providing the album ID of another user, then obtain the...

h5io deserialization injection vulnerability

Versions prior to h5io 0.2.6 contain a security vulnerability. This vulnerability arises because the readhdf5 function passes the contents of the timezone node to eval, which then imports any module specified by the class or custom-object nodes. Additionally, it deserializes pickle objects within...

itsourcecode Airline Reservation System input validation error vulnerability

Version 1.0 of itsourcecode Airline Reservation System contains a security vulnerability stemming from improper handling of the ID parameter in the /admin/managebooked.php file, which may lead to SQL injection...

NTOPNG buffer error vulnerability

Versions of ntopng prior to 6.7.260721 contain a buffer error vulnerability. This vulnerability arises because ndpigetcustomcategorymatch writes a four-byte value representing an NDPI protocol category into the IpAddress::reloadBlacklist function within src/IpAddress.cpp via a pointer to a two-by...

Kyverno resource management error vulnerability

Versions 1.11.0 through 1.19.2 of Kyverno contain a resource management error vulnerability. This vulnerability stems from an unbounded decompression issue in FetchSignatureBlob. Attackers can exploit this by controlling registry referrers or signatures to deliver highly compressed notary signatu...

Tiny Humans OpenHuman authorization issue vulnerability

Versions of Tiny Humans OpenHuman prior to 0.56.0 contain a security vulnerability. This vulnerability arises because the runtime allows pages containing webviews for remote accounts on macOS to invoke getDisplayMedia without any real-time user gestures. Instead of rejecting such requests, the...

Apache OFBiz code injection vulnerability

A code injection vulnerability exists in Apache OFBiz versions from 24.09 up to and including 24.09.08. This vulnerability stems from improper authorization in ContentWorker. Unauthenticated remote attackers can exploit the publicly accessible showHelpPublic view by setting the serviceName field ...

SuiteCRM SQL injection vulnerability

Security vulnerabilities exist in SuiteCRM versions prior to 7.15.2 and from 8.0.0 up to 8.10.2. These vulnerabilities arise because, when generating AOR reports, attacker-controlled labels on stored fields are permittedly concatenated into the ORDER BY clause. This may lead to SQL injection...

Kyverno authorization issue vulnerability

Versions prior to Kyverno 1.19.2 contain an authorization issue vulnerability. This vulnerability stems from an authorization bypass in the Generation Handler, allowing users with create or update permissions to trigger synchronization of generation policies by forging the internal...

Java Open Source Libraries Vault Java Driver Resource Management Error Vulnerability

In versions 5.2.0 through 6.2.3 of the Java Open Source Libraries Vault Java Driver, there is a resource management error vulnerability. This vulnerability arises when the minimal-json parser—which lacks nested depth restrictions—is used to parse Vault’s JSON responses. Deeply nested values can...

SuiteCRM SQL injection vulnerability

Versions prior to SuiteCRM 7.15.2 and versions 8.0.0 through 8.10.2 contain an SQL injection vulnerability. This vulnerability arises because the parametervalue within the Multi report condition is directly concatenated into the SQL WHERE clause after being processed by unencodeMultienum. The...

Apache Juneau code injection vulnerability

Apache Juneau versions 9.2.0 and earlier contain a code injection vulnerability. This vulnerability stems from improper control over dynamically loaded code. When parsing values into properties of type java.lang.Class—including those in parameterized form—the default class swap loads the specifie...

Keycloak encryption issue vulnerability

Keycloak has an encryption-related vulnerability. This vulnerability arises because the SAML HTTP-Redirect binding implementation processes percent-encoded parameter names such as %53AMLResponse on the server side, while the signature verification logic only checks the literal parameter names...

Eosphoros DB-GPT input validation error vulnerability

Versions 0.8.0, 0.8.1, and 0.8.2 of eosphoros DB-GPT contain a security vulnerability. This vulnerability stems from the executecode function within the file codeutils.py in the CodeAction component, which may lead to code injection. Attackers can exploit this vulnerability remotely...

Apache OFBiz code injection vulnerability

Versions of Apache OFBiz prior to 24.09.08 contain a code injection vulnerability. This vulnerability stems from improper handling of special elements by the MacroScreenRenderer template engine. renderLink fails to properly quote and escape values in screen link parameters before concatenating th...

Apache OFBiz authorization issue vulnerability

Versions 24.09 of Apache OFBiz prior to 24.09.08 contain an authorization issue vulnerability. This vulnerability stems from a lack of authorization checks in ProductEvents. Remote authenticated attackers possessing only directory viewing permissions can directly invoke functions such as...

SuiteCRM authorization issue vulnerability

Versions prior to SuiteCRM 7.15.2 and versions 8.0.0 through 8.10.2 contain an authorization issue vulnerability. This vulnerability stems from identifier confusion in download.php when processing documentrevisions.id for type=Documents. The authorization check applies to an empty Documents bean...

SAMSUNG Exynos 1480 buffer error vulnerability

The SAMSUNG Exynos 1480 has a buffer error vulnerability stemming from improper resource state tracking in its device drivers; this may lead to out-of-bounds memory access...

Matt Joiner torrent resource management error vulnerability

Matt Joiner torrent versions 1.61.0 and earlier contain a resource management error vulnerability. This vulnerability arises because the tracker/http package fails to limit the response buffer for Client.Announce and Client.Scrape. Malicious attackers controlling torrent files or magnet links can...

Simple DirectMedia Layer SDL_mixer buffer error vulnerability

Versions 3.1.2 through 3.2.4 of the Simple DirectMedia Layer SDLmixer contain a buffer error vulnerability. This vulnerability stems from an incorrect offset calculation within the FetchXLaw function in src/decoderaiff.c when processing A-law or mu-law samples; it results in a stack buffer...

WordPress Content Egg authorization issue vulnerability

WordPress Content Egg versions prior to 12.1.0 contain an authorization issue vulnerability. This vulnerability stems from improper access control: permissioncheck returns true incorrectly when no X-WP-Nonce header is provided, and handlerender lacks a check for publication status. Unauthenticate...

Eosphoros DB-GPT code injection vulnerability

A security vulnerability exists in eosphoros DB-GPT versions 0.8.1 and earlier. This vulnerability stems from improper handling of special elements used by the template engine within the FileBasedSkill.getprompt function in the packages/dbgpt-core/src/dbgpt/agent/skill/claudeskill/init.py file,...

Kyverno permission and access control issues vulnerability

Versions of Kyverno prior to 1.19.2 contain a vulnerability related to permission escalation and access control. This issue arises because the admission check in generate rules verifies the permissions of the controller rather than those of the creator. As a result, namespace administrators may b...

SAMSUNG Exynos 1080 input validation error vulnerability

The SAMSUNG Exynos 1080 has an input validation error vulnerability caused by improper message validation, which may lead to memory corruption...

SAMSUNG Exynos 1480 buffer error vulnerability

The SAMSUNG Exynos 1480 has a buffer error vulnerability. This vulnerability stems from improper input validation within the ENN NeuralNetworks HAL during request processing, potentially leading to memory corruption and denial of service...

SAMSUNG Exynos 1480 resource management error vulnerability

The SAMSUNG Exynos 1480 has a resource management error vulnerability caused by improper pointer handling in the NPU driver, leading to double-free conditions...

Tiny Humans OpenHuman information disclosure vulnerability

Versions of Tiny Humans OpenHuman prior to 0.57.5 contain a security vulnerability. This vulnerability arises because the approval gateway utilizes a JSON-RPC bearer token as an identifier for approval sessions. As a result, credentials are exposed by persisting approval records, events, debug...

Kyverno race condition vulnerability

Versions of Kyverno prior to 1.18.0 and 1.19.2 contain a race condition vulnerability. This occurs because verifyImages caches its validation results using image reference strings such as tags as keys rather than binding them to verified hashes. As a result, when a cache hit occurs, signature and...

Tiny Humans OpenHuman prompt injection vulnerability

Versions of Tiny Humans OpenHuman prior to 0.57.13 contain a prompt injection vulnerability. This flaw arises because backend synchronization fails to sanitize embedded commands within external content. Additionally, ApprovalGate treats tool invocations occurring without an interactive chat conte...

Book-Readers Ebook-Speaker buffer error vulnerability

In book-readers ebook-speaker versions 6.1.0 through 6.2.0, there is a buffer error vulnerability. This vulnerability stems from the getattributes function in src/common.c, which uses unrestricted strcopy when handling the name attribute of elements; this results in a stack buffer overflow...

wasm-micro-runtime WebAssembly Micro Runtime buffer error vulnerability

The wasm-micro-runtime contains a buffer error vulnerability in versions prior to 2.4.5. This vulnerability arises from inconsistent decisions made by the fast interpreter loader within core/iwasm/interpreter/wasmloader.c regarding constant tables between the size calculation phase and the emissi...

Aozora Edgechat authorization issue vulnerability

Versions of Aozora Edgechat prior to 2.20.3 contain an authorization issue vulnerability. This vulnerability stems from the lack of authentication in the GET /files/:key route; the canAccessFile function accepts an empty user ID. As a result, unauthenticated or disabled users can download decrypt...

OpenPPL PPLNN buffer error vulnerability

OpenPPL PPLNN contains a buffer error vulnerability. This vulnerability stems from the OptGraph::InitQuantization function within the file src/ppl/nn/engines/cuda/optimizer/optgraph.cc in the CUDA Optimizer component. The parameters perchannel, bitwidth, tensormax, tensormin, and scale used by th...

Andrea Marchesini libxml buffer error vulnerability

Andrea Marchesini: Versions prior to 0.18.6 of libnxml contain a buffer error vulnerability. This vulnerability stems from a stack buffer overflow in src/nxmlparser.c. Remote attackers can write excessively long XML names into the stack buffer, causing the parsing application to crash...

SuiteCRM SQL injection vulnerability

SQL injection vulnerabilities exist in SuiteCRM versions prior to 7.15.2 and from 8.0.0 up to 8.10.2. These vulnerabilities arise because GetLatestRevision.php directly inserts getlatestforid into SQL UPDATE statements. An XSS payload bypasses quotation encoding, allowing literal quotes to be...

Symfony processing logic error vulnerability

Symfony has a security vulnerability stemming from its failure to apply media URL policies to the srcset and imagesrcset attributes. This allows hosts and protocols restricted by allowMediaSchemes or allowMediaHosts to be bypassed, enabling browsers to load images from hosts they should otherwise...

OSS Apps SplitPro authorization issue vulnerability

OSS Apps SplitPro versions 2.1.6 and earlier contain an authorization issue vulnerability. This vulnerability stems from authorization bypass, allowing authenticated users to retrieve any account details by providing any userId value to user.getUserDetails. As a result, attackers may be able to...

Kyverno authorization issue vulnerability

Versions prior to Kyverno 1.19.2 contain an authorization issue vulnerability. This vulnerability arises because the admission policy generator controller fails to respect --enablePolicyException, --exceptionNamespace, and policy type gateways when merging PolicyExceptions into generated...

SuiteCRM SQL injection vulnerability

A security vulnerability exists in SuiteCRM versions prior to 7.15.2 and from 8.0.0 up to 8.10.2. This vulnerability stems from older REST methods getentrylist, getentriescount, and query in /service/v41/rest.php. In the absence of sufficient structural validation, these methods append the query...

Huginn cross-site scripting vulnerability

Versions of Huginn prior to 2026.11.05 contain a cross-site scripting vulnerability. This flaw arises because the servicelabel helper function marks unescaped OAuth service display names as htmlsafe, potentially enabling stored cross-site scripting attacks. Authenticated attackers can exploit thi...

Kobikom path traversal vulnerability

Versions of Kobikom KobiPBX-FOP3-SEC-r1 and earlier contain a path traversal vulnerability. This vulnerability stems from improper restriction of path names and makes them susceptible to path traversal attacks...

Keycloak authorization issue vulnerability

Keycloak has an authorization issue vulnerability. This vulnerability stems from the UMA Protection API in UserManagedPermissionService failing to validate the resourceType field when a new policy is created for a user. As a result, attackers can create policies targeting resources belonging to...

Kyverno permission and access control issues vulnerability

Versions 1.17.0 through 1.19.2 of Kyverno contain a vulnerability related to permission escalation and access control. This issue stems from a lack of namespace validation in the targetMatchConstraints.expression CEL output within NamespacedMutatingPolicy. As a result, tenants within a specific...

Improper exception handling vulnerability in SAMSUNG Exynos 1080

The SAMSUNG Exynos 1080 has a vulnerability related to improper exception handling; it stems from inadequate processing of SIP packets and may lead to baseband crashes...

Kyverno encryption issue vulnerability

Versions prior to Kyverno 1.19.2 contain an encryption-related vulnerability. This vulnerability arises because matchCertificateData skips the subject and subjectRegExp checks performed by verifyImages when a signed certificate lacks a subject alternative name. As a result, authentication can be...

SuiteCRM SQL injection vulnerability

SQL injection vulnerabilities exist in SuiteCRM versions prior to 7.15.2 and 8.0.0 and later up to 8.10.2. These vulnerabilities stem from the old SOAP gateway method portalgetentrylist, which passes user-controlled where and orderby values into SQL query construction without adequate sanitizatio...

OWASP ModSecurity ModSecurity input validation error vulnerability

OWASP ModSecurity versions from 3.0.0 up to and including 3.0.17 contain an input validation error vulnerability. This vulnerability arises because src/transaction.cc performs a case-sensitive comparison between the Content-Type value and the SecResponseBodyMimeType entry; mixed-case response med...