Sy460129

The `evalImageTypeValue()` function in `BackendWidgetsLists` interpolates the result of `ImageResizer::filterGetUrl()` into a single-quoted image source attribute without proper escaping. When a third-party plugin renders an attacker-influenced value through an image list column, an unsupported image value is returned verbatim. This allows an attacker to break out of the attribute and inject arbitrary attributes, such as event handlers, which execute in the session of the backend user viewing the list. A default installation is unaffected as the core does not ship with an image list column; exploitation requires a plugin that renders attacker-influenced values through one.

Stirling-PDF is a locally hosted web application used for PDF file operations. Versions prior to 2.5.2 have an issue where the `/api/v1/convert/markdown/pdf` endpoint does not properly validate paths when extracting entries from user-supplied ZIP files. This allows an authenticated user to write files outside the intended temporary directory, resulting in arbitrary file write with the privileges of the `stirlingpdfuser` process. This can lead to overwriting writable files and compromising data integrity. The vulnerable parameter is the ZIP file provided to the `/api/v1/convert/markdown/pdf` endpoint.

ClipBucket is an open source video sharing platform. A normal authenticated user can store a cross-site scripting (XSS) payload, which is then triggered by an administrator.

ClipBucket is an open source video sharing platform. Prior to version 5.5.3 #59, collection item operations are susceptible to authorization flaws. Authenticated users can modify collection items belonging to other users. This is due to missing authorization checks when adding items via the `/actions/add to collection.php` endpoint and a broken ownership check in the `removeItemFromCollection()` function during item deletion via the `/manage collections.php?mode=manage items...` endpoint. Attackers can insert and remove items from collections they do not own.

iccDEV is a set of libraries and tools for working with ICC color management profiles. A signed integer overflow in the `iccFromCube.cpp` file during multiplication can lead to undefined behavior, potentially causing crashes or incorrect ICC profile generation when processing specially crafted or large cube inputs. The issue is addressed by commit 43ae18dd69fc70190d3632a18a3af2f3da1e052a.

A heap-buffer-overflow issue exists in the tcpliveplay utility. This occurs when processing a crafted pcap file, specifically within the checksum calculation logic at the `do checksum math liveplay` function in `tcpliveplay.c`. This can lead to a denial of service.