An integer overflow vulnerability exists in Netpbm versions before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 in the jbigtopnm component. This flaw causes a heap buffer overflow when calculating the output buffer size for multi-plane JBIG files with large header dimensions. Exploitation can lead to application crashes or potentially arbitrary code execution.
Otter Wiki versions from 2.20.1 up to but not including 2.26.2 have a file disclosure vulnerability in the DataTable embedding feature. This flaw allows attackers who can edit pages, including anonymous users under default settings, to read internal repository files by specifying absolute paths such as /.git/config. The vulnerability was fixed in version 2.26.2.
A heap buffer overflow vulnerability exists in Netpbm's xpmtoppm utility before versions 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08. The flaw arises from an unvalidated characters-per-pixel value in the XPM header, allowing crafted XPM files with characters-per-pixel greater than 3 to overrun fixed 3-byte colorName hash entries. This can cause application crashes or potentially enable code execution.
An Otter Wiki before 2.26.2 contains a stored cross-site scripting vulnerability in OtterwikiMdRenderer.block_code that allows attackers who can edit pages, including anonymous users under the default configuration, to inject arbitrary script. Attackers can place HTML inside a math fenced code block, which is rendered unescaped and executes for every viewer of the page.
Netpbm versions before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contain a stack-based buffer overflow vulnerability in the picttoppm utility's scanPoly() function. This flaw occurs when processing crafted PICT files with polygon edges exceeding 5000 points, leading to overflow of the coord stack array. Exploitation can cause a crash or potentially allow code execution.
Camaleon CMS versions prior to 2.9.2 have an insecure direct object reference (IDOR) vulnerability in the Admin::CategoriesController. This flaw allows authenticated users with permissions for one post type to modify or delete categories associated with other post types by manipulating category IDs in update or destroy requests. The vulnerability can lead to unauthorized category renaming or deletion.
Netpbm versions before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contain a stack-based buffer overflow vulnerability in the picttoppm paintPoly() function. This flaw arises from an unbounded polygon point count, allowing attackers to supply a crafted PICT file with a polygon exceeding 100 points. Exploitation can lead to application crashes or potentially arbitrary code execution.
A heap-based buffer overflow vulnerability exists in Netpbm's sgitopnm readChannels() function when processing RLE-compressed SGI images. This affects versions before 10.86.51, all 11.x versions before 11.02.29, and 11.03 versions before 11.15.07. Crafted SGI files with oversized offset table lengths can cause memory corruption, leading to crashes or potential code execution.
Netpbm versions prior to 10.86.51, 11.02.30, and 11.15.08 contain an integer overflow vulnerability in the winicontopam component. This flaw allows attackers to supply crafted icon files with dimensions exceeding 32767, causing integer overflow in 16-bit signed loop counters. The overflow leads to negative row buffer indices, resulting in heap memory corruption that can cause application crashes or potentially enable code execution.
Camaleon CMS versions prior to 2.9.2 have a missing authorization vulnerability in the Admin::MediaController. This flaw allows authenticated users with low privileges to bypass role-based media permissions, enabling unauthorized file uploads, access to private media files, and modification of other users' avatars.
PandaWiki versions 3.65.0 through 3.87.5 have a stored cross-site scripting (XSS) vulnerability. Unauthenticated attackers can upload HTML files disguised with image extensions via the /share/v1/common/file/upload endpoint. By tricking administrators into visiting a crafted URL, attackers can bypass nginx's attachment header to serve the HTML inline, enabling theft of the panda_wiki_token JWT and potential session takeover.
MrDoc versions through 1.1.1 have a missing authorization vulnerability in the get_doctemp view. Authenticated users can exploit this flaw to read document templates belonging to other users by enumerating the sequential doctemp_id POST parameter. This allows unauthorized access to private template content.
Keyfactor EJBCA versions through 9.3.3 have a vulnerability where insufficient authorization checks occur during client certificate self-renewal via the RA User Interface. An authenticated remote user with a valid client certificate and RA UI access can renew their certificate even if policy or profile settings should prevent it.
Chatify versions before 1.6.4 have an authorization bypass vulnerability in the Pusher channel authorization endpoint. This flaw allows authenticated users to subscribe to private channels of other users by supplying arbitrary channel names. Exploiting this, an attacker can receive the victim's incoming private messages and attachments in real time.
OpenCSG CSGHub versions through 2.6.0-ce have an authorization bypass vulnerability in an unauthenticated file resolve route. This flaw allows remote attackers to read private repository files by injecting a percent-encoded current_user parameter into the file path. The portal forwards this request with its server API key, enabling unauthorized access to private model, code, or space repositories.
A vulnerability in inih before revision 63 allows a one-byte stack buffer under-read in the ini_parse_stream() function. This occurs when an attacker supplies an INI file or string containing a line of at least INI_MAX_LINE-1 bytes followed by an embedded NUL byte, leading to reading memory out-of-bounds. The issue causes undefined behavior detected by memory sanitizers but does not impact confidentiality or integrity.
A missing authorization vulnerability exists in Product Gallery Slider & Additional Variation Images for WooCommerce versions 2.3.23 up to but not including 2.3.26. This flaw affects Codestar backup AJAX actions (csf-export, csf-import, csf-reset), allowing Shop Managers to exploit the csf_backup_nonce from the settings page and manipulate WordPress options arbitrarily, including wp_user_roles. This can lead to privilege escalation to administrator.
Warracker versions before 1.0.4 have a missing authorization vulnerability in their Paperless-ngx integration. This flaw allows authenticated users without administrative privileges to bypass document ownership restrictions. By exploiting insufficient authorization checks in specific route handlers, an attacker can access private documents of other users through the shared Paperless-ngx API credential, leading to unauthorized disclosure of confidential information.
Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0 through 4.1.3 contain an improper isolation vulnerability. An administrator with sufficient entitlements can import BPMN process definitions via the REST API and start them. If the BPMN process includes a JUEL expression, it is executed directly on the server without sandboxing, potentially leading to unsafe execution of expressions. Versions 4.0.9 and 4.1.4 address this issue by rejecting BPMN definitions that include expression attributes.
An out-of-bounds read vulnerability exists in the Apache Arrow Rust 'arrow' crate affecting versions from 33.0.0 through 57.3.1, 58.4.0, 59.3.1, and 60.0.0. The flaw arises from improper validation of RunEndEncoded arrays in the ArrayData interface, which can lead to reading data beyond the bounds of the child values array. This issue is fixed in versions 57.3.2, 58.4.1, 59.3.2, and 60.1.0.