CVE Vulnerability Catalog

A vulnerability in Amazon AWS Load Balancer Controller before version 3.4.2, caused by incorrect behavior order in Gateway API listener-rule generation, allows an authenticated remote user to intercept, spoof, or deny another namespace's gRPC traffic on a shared Gateway via a crafted HTTPRoute resource.

A server-side request forgery (SSRF) vulnerability in the pagination component of AWS HealthLake MCP Server before version 0.0.14 allows a remote authenticated user to redirect pagination requests to an arbitrary endpoint. By crafting a malicious next_token parameter, an attacker can exfiltrate AWS temporary security credentials.

A resource allocation without limits or throttling vulnerability in .NET allows an unauthorized attacker to cause a denial of service over a network.

Code injection vulnerability in .NET Framework allows an unauthorized attacker to elevate privileges locally.

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.

Resource allocation without limits or throttling in .NET Framework. An unauthorized attacker can remotely cause a denial of service (DoS).

A protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.

An incorrect authorization vulnerability has been discovered in .NET that allows an unauthorized attacker to bypass a security feature over a network.

Stack-based buffer overflow in .NET Framework. An unauthorized attacker can remotely cause a denial of service (DoS).

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.

The .NET platform does not limit resource allocation, allowing an unauthorized attacker to perform a denial-of-service attack over a network.

Improper input type validation in .NET Framework allows an unauthorized attacker to cause a remote denial of service (DoS).

A vulnerability in Symfony affects NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS by omitting IPv6 transition prefixes (such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6). This allows attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block.

A vulnerability in Symfony allows an unauthenticated attacker, via a failed login request with a _failure_path parameter, to dispatch a subrequest to protected GET routes while bypassing firewall listeners. This occurs when failure_forward: true is enabled.

A Path Traversal vulnerability in Animate could lead to arbitrary code execution in the context of the current user. An attacker can exploit this to access sensitive files or directories outside intended restrictions. Exploitation requires user interaction, as a victim must open a malicious file.

An Incorrect Authorization vulnerability in Animate could allow arbitrary code execution in the context of the current user. Exploitation does not require user interaction but depends on conditions beyond the attacker's control. The scope of the vulnerability has changed.

An Incorrect Authorization vulnerability in Animate could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction (opening a malicious file) and depends on conditions beyond the attacker's control. The scope has changed.

Animate is affected by an OS Command Injection vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction to open a malicious file. The scope has changed.

Animate is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, as a victim must open a malicious file. The scope has changed.

Animate is affected by an OS Command Injection vulnerability that could allow arbitrary code execution in the context of the current user. Exploitation requires user interaction to open a malicious file. The scope has changed.