CVE Vulnerability Catalog

In the Zephyr RTOS network sockets subsystem (subsys/net/lib/sockets/sockets_tls.c), a potential out-of-bounds write/read exists in the TLS socket connect path. When the TLS session cache is enabled, tls_session_store() and tls_session_restore() memcpy the caller-supplied address into a fixed-size buffer using the caller-controlled addrlen value without validating it against the destination size. This can lead to reading and writing past the end of the address memory, potentially causing a crash and denial of service, and possibly arbitrary code execution.

IRIS is a web collaborative platform that helps incident responders share technical details. Versions prior to 2.4.28 do not properly validate uploaded files, allowing misuse for hosting phishing pages and introducing a Cross-Site Scripting (XSS) vulnerability.

Iris platform prior to version 2.4.28 contains a weakness that allows an attacker to redirect the user to a malicious website. This is an open redirect vulnerability.

An integer underflow in bt_mesh_sol_recv() in the Bluetooth Mesh solicitation handling leads to an out-of-bounds write. When CONFIG_BT_MESH_OD_PRIV_PROXY_SRV is enabled, the function parses solicitation PDUs from raw BLE advertising payloads. The AD parsing loop reads an attacker-controlled length byte and computes reported_len - 3 without checking that reported_len >= 3. When reported_len is less than 3, the subtraction yields a negative value that bypasses the length guard and is then implicitly converted to a very large size_t when passed to net_buf_simple_pull_mem(). In builds without assertions, this wraps the buffer length and advances the data pointer far out of bounds, so subsequent reads dereference invalid memory. A nearby BLE device can trigger this with a non-connectable advertisement carrying a UUID16 AD structure and a crafted length byte, with no pairing or prior association required, potentially leading to denial of service or arbitrary code execution.

NAVTOR NavBox up to version 4.16.1.20 contains hard-coded credentials in its Windows Communication Foundation (SOAP) implementation. A local attacker can extract these credentials to bypass the intended transfer workflow and gain access to privileged WCF methods, enabling file write or overwrite within application-defined paths.

The codec-ohttp implementation in netty incubator codec.bhttp prior to version 0.0.22.Final does not verify that a cryptographically-signed final chunk was received before the outer HTTP body terminates. An on-path attacker can truncate the message and close the body without causing a decryption error.

quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large trailer field section with many unique field names and/or large values.

A missing upper-bound check in the udpif_set_threads() function of Open vSwitch v3.6.90 allows an attacker with OVSDB write access to request an excessive number of handler or revalidation threads, causing a denial of service (DoS) via resource exhaustion.

Cross Site Scripting (XSS) vulnerability in the "Task in Progress / Recent" page in Arket Globe Document Intelligence 5.0.0.559 due to improper sanitization of user input in text fields when creating a new document. An authenticated attacker can submit data containing JavaScript code that will be executed in the browsers of other users viewing the page.

In netty incubator codec.bhttp prior to version 0.0.21.Final, HKDF_expand returns non-NULL on failure, leading to an all-zero key. Also, EVP_HPKE_CTX_export returns an empty zero-filled array on failure, resulting in a deterministic, predictable AEAD key.

Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks. Unicode digits such as the Arabic-Indic One (U+0661) were accepted but not properly parsed as numbers, which could allow network masks to accept larger networks.

Vulnerability in Net::Statsd for Perl before version 0.13 allows metric injection. Metric names are not sanitized for newlines, colons, or pipes, enabling injection of fake metrics. The update_stats and gauge methods do not validate numeric values.

The tarfile.data_filter function in Python can be bypassed using crafted symlinks, allowing files to be written outside the target directory during tar extraction. An attacker can place files in arbitrary locations.

OpenTelemetry-Go prior to version 0.0.17 leaks one file descriptor on each successful `ParseFile` call. Repeated parsing in a long-running process can exhaust the file descriptor limit and cause denial of service.

OpenTelemetry-Go versions 1.41.0 and 1.43.0 removed raw-length rejection, causing `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.

LIBPNG version 1.8.0 has a bug in the push-mode APNG parser: three inter-frame chunk discard paths do not consume the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to png_process_data.

In the Hostel-Management-System-PHP up to version f87e67c283bab6f718faf2fec6ae39a13bd7036b, the file hostel/index.php in the Admin Dashboard Page component lacks authorization for the ID argument. The attack can be performed remotely, and the exploit is publicly available.

In milvus-io milvus up to version 2.6.13, the file internal/metastore/kv/rootcoord/kv_catalog.go in the Grantee ID Hash Handler component uses a weak hash. The attack requires local access and is difficult to exploit.

Strawberry GraphQL versions 0.172.0 through 0.315.6 incorrectly count aliases when expanding FragmentSpreadNode. An attacker can bypass alias limits and force the server to resolve a significantly higher number of aliases than allowed, leading to resource exhaustion and denial of service (DoS).

Strawberry GraphQL versions 0.71.0 through 0.315.6 are vulnerable to a DoS attack in the QueryDepthLimiter extension. Lack of cycle detection in fragment spreads causes infinite recursion and a RecursionError. Fixed in version 0.315.7.