CVE Vulnerability Catalog

The Net::IMAP library in Ruby has a vulnerability that allows arbitrary IMAP command injection if the server does not support non-synchronizing literals. Versions prior to 0.6.5 and 0.5.15 are susceptible to an attack that may lead to unauthorized command execution.

Jupyter Server prior to version 2.20 has a stored XSS vulnerability in nbconvert handlers. A notebook with an HTML payload in display_data output can lead to cookie theft, full API access, and kernel RCE.

The Authlib library before versions 1.6.10 and 1.7.1 contains an unauthenticated open redirect vulnerability in the OAuth 2.0 authorization endpoint. By sending a request with an unsupported response_type and an attacker-controlled redirect_uri, an HTTP 302 response redirecting to an arbitrary URL can be obtained.

Gophish through version 0.12.1 contains a denial of service vulnerability that allows authenticated users with the User role to exhaust server memory by uploading a crafted Office document as an email template attachment. The ApplyTemplate() function in models/attachment.go processes Office documents as ZIP archives and calls ioutil.ReadAll() on each contained file entry without enforcing size restrictions on uncompressed content, allowing a zip bomb payload to expand to several gigabytes in memory and cause the process to be terminated by the operating system.

A vulnerability in Dell Wyse Management Suite (WMS) prior to version 2605 involves the use of default credentials. It allows an attacker with high privileges and local access to disclose sensitive information.

IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to a denial of service (DoS) attack in the WebSphere WebServer Plug-in component. An attacker can send crafted requests to the web server, causing system overload.

LangChain prior to version 1.3.9 contains a vulnerability where several components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include file-search middleware, configuration loaders, and path-prefix authorization checks that can allow access to files outside the configured root via glob patterns, symlinks, or path segment boundary bypass.

A vulnerability in @astrojs/netlify prior to version 7.0.13 allows for improper matching of image patterns, potentially leading to unauthorized access to resources. Patterns using wildcards can match more paths and hosts than intended.

In versions prior to 6.4.6 of the Astro framework, the spreadAttributes function in the server-side rendering pipeline did not sanitize object keys against injection, allowing attackers to add arbitrary HTML attributes, including event handlers.

The Hono framework prior to version 4.12.25 has a vulnerability in the Body Limit middleware, which trusts the request's Content-Length header to determine if the body is within the allowed limit. On AWS Lambda, a client can declare a smaller Content-Length while sending a larger body, allowing them to bypass the limit.

The ALSA library before version 1.2.16.1 has a double-free vulnerability in parse_def() in src/conf.c. When parsing nested compound or array configuration blocks, missing return value checks cause snd_config_delete() to be called twice on the same already-freed node, leading to a NULL-pointer write or invalid memory read.

Hono is a web application framework that prior to version 4.12.25 on AWS Lambda@Edge had an issue with repeated request headers. The adapter wrote header values using Headers.set, causing earlier values to be overwritten, and only the last one reached the application.

Hono is a web application framework that supports any JavaScript runtime. Prior to version 4.12.25, on AWS Lambda, ALB single-header responses and VPC Lattice v2 responses join multiple Set-Cookie headers into one comma-separated value, leading to issues with proper processing by clients.

In Hono framework before version 4.12.25 on Windows hosts, an encoded backslash (%5C) in the request path decodes to a separator, allowing an attacker to read static files protected by prefix-mounted middleware.

In versions prior to 2.8.0 of the opentelemetry-js library, the W3CBaggagePropagator.extract() method in @opentelemetry/core does not enforce size limits when parsing HTTP headers. The W3C Baggage specification recommends a maximum size of 8,192 bytes and 180 entries, which was not enforced for incoming headers.

In AIOHTTP before version 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. The attack requires an open redirect vulnerability on the target domain, and the attacker only receives the digest, allowing credential extraction only if cryptography is weak or passwords are reused.

Versions of protobufjs from 8.2.0 to 8.4.2 lacked options to discard unknown fields during decoding, which could lead to excessive memory usage by decoded messages. Version 8.5.0 introduced options to disable unknown field retention, and version 8.6.2 defaults to discarding unknown fields.

In versions prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. This could lead to deterministic exceptions or recursive calls in various operations related to decoding and serialization.

The launch-editor package allows users to open files with line numbers in the editor from Node.js. Prior to version 2.14.1, this package accesses arbitrary paths, including Windows UNC paths, leading to the leakage of the user's NTLMv2 password hash.

A Cross-Site Scripting (XSS) vulnerability exists in Angular's @angular/platform-server component when serializing <noscript> elements during SSR. The domino library fails to escape </noscript> in dynamic content, allowing injection of malicious scripts.