CVE Vulnerability Catalog

In versions prior to 1.4.0 of Nimiq, the LightBlockchain::rebranch() function does not correctly update the macro and election state after adopting a fork chain, leading to verification issues with blocks. This can cause stalls in the light client's chain progression.

In versions prior to 1.4.0, Nimiq has a logic flaw in the BlockInclusionProof::is_block_proven function that allows a MacroBlock header to be accepted as 'proven' without cryptographic verification. This issue occurs when the hop list is empty, which can be exploited by an attacker to forge transaction inclusion proofs.

FlashMQ is an MQTT broker/server that prior to version 1.26.2 allowed authorized clients to exceed the permitted write buffer over-commit, triggering an internal safeguard exception. This exception was not catchable, leading to server abort.

In versions prior to 1.4.0, the network-libp2p library in Nimiq improperly handles DHT record verification errors, potentially leading to future queries hanging indefinitely.

A vulnerability in Spring Data REST allows an attacker to pass arbitrary persistent property paths as request parameter filter keys without considering Jackson customizations before handing them to Querydsl. This could lead to unauthorized data access or data leakage.

A vulnerability in Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients.

The vulnerability in Spring Kafka concerns the retry topic infrastructure, which did not sufficiently validate user-controlled header values. A producer could send a record with a crafted retry_topic-attempts header containing an out-of-range attempt count, causing the retry topic router to misidentify the message's position in the retry sequence.

A vulnerability in Spring for Apache Kafka allows an attacker producer to unboundedly increase the consumer's heap memory usage by sending records with unique `spring.kafka.serialization.selector` header values, leading to GC thrash and OutOfMemoryError.

A vulnerability in Spring Data Commons can lead to a Denial of Service (DoS) condition when Spring Data Web Support is enabled with a Controller method using @ProjectedPayload. An attacker can send a crafted HTTP request causing excessive memory allocation.

A SpEL Injection vulnerability in Spring Data KeyValue occurs when unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. An attacker can inject malicious SpEL expressions, leading to remote code execution.

Vulnerability in Spring AMQP causes applications using RabbitConnectionFactoryBean.setUri("amqps://...") without calling setUseSSL(true) to get TLS encryption with no certificate validation and no hostname verification.

Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters.

Vulnerability in Spring Security's CookieRequestCache and CookieServerRequestCache stores the full absolute pre-authentication request URL in a browser cookie. After successful login, the user is redirected to this URL without validation, allowing an attacker to manipulate the redirect target.

Correlation IDs for replies in RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to an internal simple counter.

Vulnerability in Spring Data Relational involves improper escaping of binding values for externally-controlled input when using StringMatcher (STARTING, ENDING, or CONTAINING) in Query By Example (QBE). An attacker can supply wildcard characters to perform boolean-based blind data inference.

In Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding, there is insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting.

The vulnerability in Spring Security Authorization Server is due to insufficient validation of the request_uri parameter in the authorization endpoint. An attacker can craft a malicious authorization request with an invalid request_uri and an arbitrary, unvalidated redirect_uri, leading to an Open Redirect vulnerability.

Vulnerability in Spring REST Docs allows an XXE (XML External Entity) attack when documenting a remote API over HTTP. An attacker can compromise the API or trick the user into documenting a malicious API, leading to an attack when documentation-generating tests are next executed.

An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.

An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS.