The Sleuth Kit versions up to 4.15.0 have a NULL pointer dereference vulnerability in the decmpfs_decompress_lzvn_attr() function. This flaw allows attackers to crash the tool by providing a specially crafted HFS+ image with a manipulated LZVN inline com.apple.decmpfs attribute. The vulnerability leads to denial of service due to a failed allocation and subsequent NULL pointer write.
The Sleuth Kit versions through 4.15.0 have a heap out-of-bounds read vulnerability in the hfs_load_extended_attrs() function. This flaw occurs because the function reads the decmpfs header without verifying the attribute length, allowing crafted HFS+ images with specific attribute sizes to cause out-of-bounds reads and crash analysis tools such as istat or icat.
libgphoto2 versions up to 2.5.34 contain stack-based and heap-based buffer overflow vulnerabilities in the jl2005c_init() function. These vulnerabilities allow malicious USB devices, specifically spoofed Jeilin JL2005B/C/D cameras, to supply an unbounded allocation table entry count. This can lead to memory corruption by overwriting the saved return address and heap data, potentially enabling code execution.
A heap out-of-bounds read and write vulnerability exists in libgphoto2 through version 2.5.34 in the jl2005bcd_decompress() function. This flaw allows malicious USB cameras to corrupt heap memory by processing oversized thumbnails. Specifically, attackers can manipulate allocation-table values and a thumbnail header byte to cause in-place byte-swapping to exceed the buffer by approximately 30 KB, potentially leaking heap contents in preview images.
LaraDashboard versions from 1.4.0 up to but not including 1.4.9 have an improper authorization vulnerability. Authenticated users with only read-only email_template.view permission can exploit this flaw to send arbitrary emails through the MCP send-email tool. This allows attackers to generate MCP tokens and send emails with any recipient, subject, and raw HTML content, potentially facilitating phishing or spam campaigns.
DoraCMS versions through 3.1.0 have a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint. This flaw allows authenticated users with low privileges to reassign their API key to another user's account by modifying the userId field. Exploiting this, an attacker can impersonate the victim to alter profiles and publish or delete content.
HotGo versions through 2.15.1 have an authentication bypass vulnerability that allows unauthenticated attackers to specify the SMS login verification code via the /admin/sms/send endpoint. An attacker who knows a user's mobile number can set a known code and then log in through /admin/site/mobileLogin, potentially taking over user accounts, including administrator accounts.
Outline versions before 1.12.0 have an improper access control vulnerability that allows unauthenticated users to read unpublished documents. This occurs because the share loader does not respect the unpublished status of documents. Attackers with an existing share link can access withdrawn content via specific share-related routes, while attempts to revoke shares return a 404 error, preventing revocation.
madong-admin-saas versions through 5.1.4 have a critical missing authentication vulnerability in the platform tenant management API. The 'platformapi' middleware key does not properly match the 'platform' application, allowing unauthenticated remote attackers to access tenant management endpoints. Attackers can list, create, modify, disable, or delete tenants and bind subscription plans without authentication.
QuickJS-NG versions before 0.16.0 have an integer overflow vulnerability in the js_typed_array_sort() function. This flaw allows attackers who can execute JavaScript to cause a heap buffer overflow on 32-bit systems by invoking TypedArray.prototype.sort with a comparator on very large typed arrays. The overflow can lead to crashes or potentially arbitrary code execution.
GoFound versions through 1.4.1 have a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by using ../ sequences in the database parameter. This can be exploited by sending crafted GET requests to /api/db/create and /api/db/drop endpoints, causing the server to remove directories outside the intended data directory.
madong-admin-saas versions through 5.1.4 have an incorrect authorization vulnerability in AccessTokenMiddleware. This flaw allows authenticated tenant users in multi-tenant mode to access platform management APIs improperly. Exploitation enables attackers to reuse tenant login JWTs to create platform administrator accounts, read tenant database settings, and gain control over all tenants.
QuickJS-NG versions before 0.16.0 have an integer overflow vulnerability in the js_proxy_get_own_property_names() function within quickjs.c. This flaw can lead to a heap buffer overflow on 32-bit systems when JavaScript code returns a large array-like object from a Proxy ownKeys trap. The vulnerability may cause application crashes or potentially allow code execution.
GoFound versions through 1.4.1 have a stored cross-site scripting (XSS) vulnerability. Unauthenticated attackers can submit malicious document text to the /api/index endpoint, which is then indexed and returned unescaped by searcher/engine.go. The dashboard.vue component renders this content using v-html, causing script execution in an administrator's browser when a search matches the malicious document.
OwnTone Server versions through 29.3 have an SQL injection vulnerability in the mpd_sticker_find() function within src/mpd.c. This flaw allows unauthenticated remote attackers to inject SQL commands via the URI argument. Exploitation involves sending a crafted 'sticker find song' command to the MPD listener on TCP port 6600, enabling attackers to bypass path restrictions and enumerate all media files along with their filesystem paths and metadata.
An authentication bypass vulnerability exists in ape-volo-admin versions before 3.6.1. This flaw allows unauthenticated attackers to forge administrator tokens by exploiting a hardcoded JWT signing key found in the appsettings.json file. Using this key, attackers can create tokens offline with the jti claim set to the seeded administrator ID, granting full API control over users, roles, permissions, and data.
QuickJS-NG versions prior to 0.16.0 have a memory leak vulnerability in the js_atomics_store() function. This flaw occurs when the function fails to free a converted value upon returning a RangeError. An attacker running JavaScript can exploit this by repeatedly calling Atomics.store with a crafted valueOf that detaches or shrinks the buffer, leading to heap memory exhaustion and denial of service.
Netpbm versions before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contain an out-of-bounds read vulnerability in the tgatoppm converter. This flaw arises from unchecked pixel values used as color map indexes, allowing crafted Targa files with pixel values exceeding color map bounds to cause a crash or leak adjacent memory.
An integer overflow vulnerability exists in Netpbm versions before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 in the jbigtopnm component. This flaw causes a heap buffer overflow when calculating the output buffer size for multi-plane JBIG files with large header dimensions. Exploitation can lead to application crashes or potentially arbitrary code execution.
Otter Wiki versions from 2.20.1 up to but not including 2.26.2 have a file disclosure vulnerability in the DataTable embedding feature. This flaw allows attackers who can edit pages, including anonymous users under default settings, to read internal repository files by specifying absolute paths such as /.git/config. The vulnerability was fixed in version 2.26.2.