CVE Vulnerability Catalog

Adobe Experience Manager is affected by a Path Traversal vulnerability that allows unauthorized file system read outside the intended scope. An attacker can exploit this to access sensitive files and directories without user interaction.

Adobe Experience Manager is affected by a Missing Authentication for Critical Function vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation does not require user interaction and the scope is changed.

A vulnerability in the @grpc/grpc-js library allows an attacker to send an invalid compressed message, causing a crash of the client or server process. The issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

A vulnerability in the @grpc/grpc-js library allows remote crash of the server by sending an invalid HTTP/2 stream initiation request. Affected versions are prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

Adobe Commerce is affected by an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This allows a high-privileged attacker to execute arbitrary code in the context of the current user.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could exploit this to bypass security measures and gain unauthorized read and limited write access, causing limited disruption to availability. Exploitation does not require user interaction.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could exploit this to bypass security measures and gain unauthorized read and limited write access. Exploitation does not require user interaction.

Puma versions 5.5.0 through 7.2.1 and 8.0.2 are vulnerable to source IP spoofing. When proxy_protocol: :v1 is enabled and persistent connections are used, Puma incorrectly re-parses PROXY headers after each keep-alive request, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR.

A vulnerability in Puma (versions 5.5.0 through 7.2.1 and 8.0.2) with PROXY protocol v1 support enabled allows an attacker to continuously send bytes without CRLF, causing unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer.

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause missing release of memory after effective lifetime. A successful exploit of this vulnerability might lead to denial of service.

NVIDIA Triton Inference Server for Linux contains a vulnerability that allows an attacker to trigger an uncaught exception. Successful exploitation of this vulnerability could lead to denial of service.

A vulnerability in NVIDIA Triton Inference Server for Linux allows an attacker to cause uncontrolled resource consumption. Successful exploitation could lead to denial of service (DoS).

A vulnerability in the NVIDIA Triton Inference Server for Linux allows an attacker to use an expired file descriptor. Successful exploitation could lead to denial of service (DoS).

NVIDIA Triton Inference Server for Linux contains a stack-based buffer overflow vulnerability. Successful exploitation could lead to denial of service.

NVIDIA Triton Inference Server for Linux contains a vulnerability that allows an attacker to cause uncontrolled resource consumption. Successful exploitation of this flaw may lead to denial of service (DoS).

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to re-clone an XSS payload after sanitization so that unsanitized markup inside <selectedcontent> is returned. This issue is fixed in version 3.4.5.

A vulnerability in Symfony allows XML External Entity (XXE) injection when processing XML via the Crawler::addXmlContent() method. Setting DOMDocument::$validateOnParse = true before loadXML() re-enables external entity resolution, allowing an attacker to read local files using file:// entities.

A vulnerability in Symfony SendmailTransport in -t mode appends recipient addresses to the sendmail command line without a -- end-of-options separator, allowing an address starting with - to be interpreted as a sendmail option. Fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.