CVE Vulnerability Catalog

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary files to filesystem locations outside the installation prefix.

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or raw_log topics can have memory corrupted, producing incorrect contract behavior.

Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer.

Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the compiler assumed each subtype size is 32.

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can return corrupted values or pass wrong arguments to external calls.

A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee.

Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host without restricting the redirect destination. A malicious HTTP server can cause the system running Metasploit to make requests to arbitrary HTTP services reachable from the operator's network, including internal services that are not otherwise accessible to the attacker.

The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host.

A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack can be executed remotely. This patch is called 713b943af94ab2d521d483b841618b97a2e78a4d.

Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images with gif_consolidate enabled. Palette indices are used without checking the colour table's bounds, reading beyond the heap allocation.

IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unauthenticated remote attacker to bypass security restrictions due to improper access control. By sending a specially crafted HTTP request to any URL within the Navigator application prior to authentication, a bad actor could exploit this vulnerability to alter server-side session security state.

Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Essbase executes to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as unauthorized update, insert or delete access to some of Oracle Essbase accessible data.

Vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. A low-privileged attacker with HTTP network access can cause a partial denial of service.

Vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. A low-privileged attacker with HTTP network access can gain unauthorized read access to a subset of Essbase data.

Vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. A low-privileged attacker with HTTP network access can perform unauthorized update, insert or delete operations, read a subset of data, and cause a partial denial of service.

Vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. A low-privileged attacker with HTTP network access can gain unauthorized read access to a subset of Essbase data, and attacks may significantly impact additional products (scope change).

Vulnerability in Oracle Essbase (Java Based Agent component) affecting version 21.8.3.0.0. A high-privileged attacker with logon to the Essbase infrastructure can gain unauthorized access to critical or all Essbase data, with possible impact on additional products.

Vulnerability in Oracle Essbase (Java Based Agent component) affecting version 21.8.3.0.0. An unauthenticated attacker with TCP network access can gain unauthorized read access to a subset of Essbase data.

Vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. An unauthenticated attacker with network access via T3 or IIOP can perform unauthorized update, insert or delete operations, read a subset of data, and cause a partial denial of service.