CVE Vulnerability Catalog

Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider. Attackers able to create or update Ingress or Service resources in one namespace can set router.middlewares or service.serverstransport annotations to obtain another tenant's injected credentials or reuse its client certificates.

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contain a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel administrators, can instantiate SplFileObject via a lowercase class name to read .env secrets or write a PHP file into the webroot for remote code execution.

Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.

Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability. An authenticated administrator can inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout(), with 'as X' or 'on X' keys bypassing cleanseConfig().

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability. An authenticated Control Panel user can escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners and injecting Yii 'as' or 'on' config keys.

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability. An authenticated Control Panel user can escape the Twig sandbox via Asset::getMimeType transforms by supplying 'as' or 'on' keys passed unfiltered to Craft::createObject.

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter. The filter invokes non-string arrow arguments as callables without the checkArrow guard, allowing authenticated users to pass an array-callable such as FileHelper::writeToFile.

A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.

A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. The xp_cmdshell function in /ws.asmx mishandles the sql argument, leading to SQL injection. The attack may be remote and the exploit has been publicly disclosed.

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input, and each buffered value revalidates the rest of the buffer.

Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys written out as Latin-1 characters.

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify. For an array or hash object with a "" overload, and from 4.20 a scalar object, it takes an extra reference that is never released.

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse. The bytes 12 decode as one value when read together, but as 1 and then 2 when split across two reads.

Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread. Callbacks and the incremental parse buffer are copied as raw scalar pointers, so the child's parser uses and later frees scalars that belong to the parent.

A vulnerability in the Cpanel::JSON::XS Perl library (versions 4.20 to 4.80) causes an out-of-bounds write during canonical encoding of a tied or threads::shared hash when the key count grows between the first and second pass. This can corrupt stack or heap memory and crash the process.

In the Cpanel::JSON::XS Perl library (versions before 4.80), incr_parse buffers input beyond max_size because it compares parsing progress rather than buffer length. A chunk starting with a NUL byte or a call in void context bypasses the check, allowing unbounded buffer growth and memory exhaustion.

In the Cpanel::JSON::XS Perl library (versions 4.28 to 4.80), the dupkeys_as_arrayref option leaks the array collecting duplicate key values in decode_hv — an extra reference is never released, so the array and its values outlive the decoded structure. The leak also occurs when decoding fails after a duplicate key.

In the Cpanel::JSON::XS Perl library (versions before 4.80), with allow_bignum, numbers in exponent notation are encoded as full decimal digits, which can lead to memory exhaustion. A small text such as [1e30000000] can encode to about 30 MB because the exponent is unbounded.

In the Cpanel::JSON::XS Perl library (versions 4.33 to 4.80), the allow_barekey option in decode_hv accepts malformed UTF-8 in bare keys because the key bytes are stored as a UTF-8 flagged string without validation. Later operations on such a key, such as lc, uc or re-encoding the hash, die with a malformed UTF-8 error.

In the Cpanel::JSON::XS Perl library (versions before 4.80), the allow_tags option in decode_tag allows stack exhaustion via nested tagged values. Tag nesting is not counted against max_depth, so a run of "(" bytes can exhaust the C stack and trigger an uncatchable segmentation fault.