Threats affecting pkg:generic/openjph

Semantic MediaWiki versions from 7.3.0 up to but not including 7.3.1 contain a missing authorization vulnerability in the smwtask API module. This flaw allows unauthenticated attackers to run queued jobs and force store updates. Exploitation can involve using the public anonymous CSRF token with the run-joblist function to execute arbitrary job types repeatedly or invoking updates on sysop-protected pages, potentially leaking page titles and exhausting system resources.

A critical stack-based buffer overflow vulnerability exists in multiple JP1 products, including JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager and Agent editions, and JP1/Base. The affected versions range from 13-00 up to but not including 13-50-31 for most products, and from 11-00 up to but not including 12-50-54 for JP1/Base. This vulnerability allows for remote exploitation without privileges or user interaction, potentially leading to high confidentiality and integrity impact with limited availability impact.

An out-of-bounds write vulnerability exists in multiple JP1 products, including JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager and Agent editions, and JP1/Base. The affected versions are prior to specific fixed releases. This vulnerability has a critical severity with a CVSS score of 9.4, indicating high impact on confidentiality, integrity, and availability.

A stack-based buffer overflow vulnerability exists in the web management interface of certain Moxa wireless device servers. An authenticated remote attacker with low privileges can exploit insufficient bounds checking on user input to cause the web management service to become unresponsive. Recovery requires power cycling the device, though other device functions continue to operate normally.

A heap-based buffer overflow vulnerability exists in multiple JP1 products, including JP1/Integrated Management 3 - Manager, JP1/Automatic Job Management System 3 - Manager and Agent editions, and JP1/Base. The affected versions range from 13-00 up to but not including 13-50-31 for the first four products, and from 11-00 up to but not including 12-50-54 for JP1/Base. This vulnerability has a high CVSS score of 9.4, indicating critical severity with potential for high impact on confidentiality and integrity.

SemanticMediaWiki versions from 3.1.0 up to but not including 7.3.1 contain a reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious scripts via the unescaped default parameter in JsonResultPrinter. Exploitation involves tricking users into visiting a specially crafted Special:Ask link with a zero-result query and a specific request_type, leading to execution of JavaScript in the context of the wiki. This can result in theft of session cookies or CSRF tokens.

Semantic MediaWiki versions from 2.5.0 up to but not including 7.3.1 contain an uncontrolled resource consumption vulnerability. This flaw allows low-privilege editors to bypass the smwgMaxNumRecurringEvents limit by supplying a large limit parameter. Attackers can exploit this by saving pages with #set_recurring_event without specifying an end date, causing the creation of thousands or millions of date subobjects. This results in exhaustion of CPU, memory, and database resources, leading to denial of service conditions.

Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.1 contain an algorithmic complexity vulnerability in the TermParser::normalize_compact_form() function. This flaw allows unauthenticated attackers to cause quadratic CPU consumption by submitting long search terms with many distinct in:(...) or has:(...) expressions to Special:Search when the extended search engine is enabled. This can exhaust PHP search workers, leading to denial of service conditions.

A critical stack-based buffer overflow vulnerability exists in HiRDB Server versions 9 and 10 within specified version ranges. The flaw allows for remote exploitation without privileges or user interaction, potentially leading to high confidentiality and integrity impact, and low availability impact.

A heap-based buffer overflow vulnerability exists in JP1/Automatic Job Management System 3 - Manager versions from 10-00 up to but not including 13-50-31. This vulnerability has a critical severity with a CVSS score of 9.4, indicating it can be exploited remotely without privileges or user interaction, potentially leading to high confidentiality and integrity impact and some availability impact.

A heap-based buffer overflow vulnerability exists in JP1/Automatic Job Management System 3 affecting Manager and Agent components from version 11-00 up to but not including 13-50-31. This vulnerability has a critical CVSS score of 9.8, indicating it can be exploited remotely without privileges or user interaction to cause high impact on confidentiality, integrity, and availability.

A heap-based buffer overflow vulnerability exists in HiRDB Server versions 9 and 10, affecting multiple sub-versions. This flaw allows an attacker to execute arbitrary code or cause a denial of service due to memory corruption. The vulnerability has a critical severity with a CVSS score of 9.8.

CVE-2026-82117 is a critical authentication bypass vulnerability affecting multiple versions of HiRDB Server. The flaw allows an attacker to bypass authentication by spoofing, potentially leading to full compromise of confidentiality, integrity, and availability of the affected systems. The vulnerability impacts HiRDB Server versions 9 and 10 within specific version ranges. The CVSS 3.1 base score is 9.8, indicating a critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided.

An authentication bypass vulnerability exists in JP1/Automatic Job Management System 3 - Manager versions from 10-00 up to but not including 13-50-31. This flaw allows an attacker to bypass authentication controls, potentially leading to full system compromise. The vulnerability has a critical severity with a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.

An OS command injection vulnerability exists in HiRDB Server versions 9 and 10 within specified version ranges. This vulnerability allows an unauthenticated attacker to execute arbitrary operating system commands, potentially leading to full system compromise. The flaw affects multiple versions of HiRDB Server and its additional function variants. The vulnerability has a critical severity with a CVSS score of 9.8.

CVE-2026-82121 is a high-severity vulnerability in HiRDB Server versions 9 and 10 involving an origin validation error. This flaw affects multiple versions of HiRDB Server and HiRDB Server with Additional Function, potentially allowing an attacker to exploit the origin validation weakness. The vulnerability has a CVSS score of 7.5, indicating a network attack vector with no required privileges or user interaction, and it impacts confidentiality. No public exploits or patches are currently documented.

A critical vulnerability identified as CVE-2026-82116 affects multiple versions of HiRDB Server. The flaw involves missing authentication for critical functions, allowing unauthenticated attackers to potentially execute unauthorized actions. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. Affected versions include HiRDB Server Version 10 from 10-00 before 10-12-01, and various releases of Version 9 and its variants up to specified builds. No patch or remediation information is currently provided.

A critical stack-based buffer overflow vulnerability exists in HiRDB Server versions 9 and 10, affecting multiple sub-versions. The flaw allows for remote exploitation without privileges or user interaction, potentially leading to full system compromise.

A missing authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine prior to 2026-08-31 allows an authenticated attacker to exfiltrate disk data across projects. This vulnerability was patched on August 31, 2026, and no customer action is required.

CVE-2026-117493 is a stored cross-site scripting (XSS) vulnerability in BloX widgets. The API endpoint /api/dashboards/<id>/widgets/<id> accepts HTML and JavaScript content in the 'desc' and 'text' parameters, which is executed in the browser when the widget is rendered. This can lead to compromise of confidentiality of information accessible in that context.