CVE Vulnerability Catalog

In Strawberry GraphQL versions 0.288.4 through 0.315.3, the bundled GraphiQL template wrote header editor values into the browser URL query string. This could expose sensitive headers like authorization tokens.

Vulnerability in GPTCache up to 0.1.44. The BufferedReader.peek function in gptcache/processor/pre.py (Cache Key Handler component) uses a weak hash for the input_data["image"] argument. Attack requires local access and high complexity. Exploit is publicly available.

HCL BigFix Cloud Lifecycle Management lacks input validation. This low-level flaw allows unauthorized access and may lead to information exposure.

Vulnerability in Streamlit up to 1.53.0. An unknown function in lib/streamlit/runtime/caching/hashing.py (Palette Handler component) uses a weak hash. Attack requires local access and high complexity. Exploit is publicly available.

In MLflow up to version 3.10.0, a flaw in mlflow.data.digest_utils causes use of a weak hash function. The attack is local, high complexity, difficult to exploit, but an exploit has been published.

HCL iControl v4.0.0 discloses a stack trace due to an unhandled exception when JavaScript code attempts to read the 'dashboard key' property from an undefined object, possibly due to a missing or improperly initialized variable.

HCL iControl has missing security headers, which enables cross-site scripting (XSS) attacks by disabling the built-in XSS filtering mechanisms of modern web browsers.

HCL iControl is missing critical cookie attributes like Secure and SameSite, and the path is set to root. This can lead to session hijacking or CSRF attacks.

In the PIL Image Cache Key Handler component in file swift/template/base.py of modelscope ms-swift up to version 4.2.0, a weak hash usage was detected. The attack requires local access and is difficult to exploit. The exploit has been publicly disclosed.

In PaddlePaddle FastDeploy up to version 2.4.1, the hash_features function in file fastdeploy/multimodal/hasher.py (MultimodalHasher component) uses a weak hash. The attack requires local access and is difficult. A patch with ID 374945747652a8d32965591c0c01a00c88b7067f is available.

A security flaw in gradio-app gradio 6.14.0 affects the save_audio_to_cache function of the Audio Cache Key Handler component. Manipulation leads to use of weak hash. The attack requires local access, is difficult to exploit, but the exploit is publicly available.

Vulnerability in SGLang up to version 0.5.11 in the data_hash function of the Cache Handler component causes denial of service (DoS) via a local attack with high complexity. Exploit has been published.

In mlrun up to version 1.12.0-rc3, the function mlrun.utils.helpers.calculate_dataframe_hash in file mlrun/utils/helpers.py (DataFrame Hash Handler component) uses a weak hash. The attack requires local access and is difficult. The exploit has been publicly disclosed.

In Django 5.2 before 5.2.15 and 6.0 before 6.0.6, `django.middleware.cache.UpdateCacheMiddleware` does not match `Cache-Control` response directives case-insensitively. A remote attacker can read responses that were incorrectly cached because their `Cache-Control` directives used uppercase or mixed-case values.

In Django (versions 6.0 before 6.0.6 and 5.2 before 5.2.15), `EmailBackend` fails to prevent reuse of a partially-initialized connection after a failed STARTTLS handshake when `fail_silently=True`. This allows on-path network attackers to read email content in cleartext.

Vulnerability in Django (versions 6.0 before 6.0.6 and 5.2 before 5.2.15) in the `get_signed_cookie` function allows an attacker to use a signed cookie in a different context than intended, by manipulating the cookie name and salt argument. This is due to non-injective salt derivation.

In Django 5.2 before 5.2.15 and 6.0 before 6.0.6, `django.utils.cache.has_vary_header()` does not strip leading or trailing whitespace from `Vary` response header values before comparison. This allows remote attackers to read cached responses via requests to URLs whose responses contain whitespace-padded Vary header values.

Daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 as header line separators, but autobahn decodes header values to str and calls splitlines(). An attacker can exploit this parser differential to inject additional headers into the ASGI scope passed to the application. daphne now rejects requests with these bytes in any header value with a 400 response.

In Django 5.2 before 5.2.15 and 6.0 before 6.0.6, `django.middleware.cache.UpdateCacheMiddleware` does not add `Authorization` to the `Vary` response header for requests bearing that header without `Cache-Control: public`. This allows remote attackers to read private cached responses via unauthenticated requests to the same URL.

An HTML injection vulnerability was found in Canarytokens notification emails for 'Slow Redirect' and 'Cloned Website'. It allows interface manipulation and XSS in email clients that render HTML.