CVE Vulnerability Catalog

Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users with delegated signing authority to bypass TUF specification integrity checks for delegated targets metadata and poison the local metadata cache, because load_delegations does not apply the same validation checks as the top-level targets metadata path.

Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users to bypass the TUF signature threshold requirement by duplicating a valid signature, causing the client to accept forged delegated role metadata.

Prior to 1.6.5, Better Auth's clientPrivileges option documents a create action, but OAuth client creation endpoints did not invoke the hook before persisting new clients. Deployments restricting client registration via clientPrivileges were not actually restricted.

In Mojic before 2.1.4, the CipherEngine uses a standard equality operator (!==) to verify the HMAC-SHA256 integrity seal during decryption. This creates an observable timing discrepancy (CWE-208), allowing an attacker to bypass the file integrity check via a timing attack. The vulnerability is fixed in 2.1.4.

4ga Boards is a boards system for realtime project management. Prior to 3.3.5, 4ga Boards is vulnerable to user enumeration via a timing side-channel in the login endpoint (POST /api/access-tokens). When an invalid username/email is provided, the server responds immediately (~17ms average). When a valid username/email is provided with an incorrect password, the server first performs a bcrypt.compareSync() operation (~74ms average) before responding. This ~4.4× timing difference is trivially detectable even over a network — a single request suffices. This vulnerability is fixed in 3.3.5.

Axios versions 1.0.0 through 1.15.1 are vulnerable to a Prototype Pollution Gadget attack, allowing modification of JSON API responses, including privilege escalation and data manipulation.

A vulnerability in Axios before versions 1.15.1 and 0.31.1 allows a Prototype Pollution attack that causes all HTTP responses (including errors 401, 403, 500) to be treated as success. Authentication and error handling are bypassed.

A vulnerability in the rust-openssl library (versions 0.9.24 through 0.10.78) causes the PSK and cookie callbacks to not validate the user closure's return value against the buffer size. This can lead to buffer overflows and other unintended consequences.

@astrojs/node before 10.0.5, when requesting static js/css resources from the _astro path with an incorrect or malformed if-match header, returns a 500 error with a one-year cache lifetime instead of 412 in some cases. As a result, subsequent requests to that file receive a 5xx error instead of the file until the cache expires.

Vim is an open source command line text editor. Prior to 9.2.0357, a command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion; if it contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user.

OpenPrinting CUPS prior to 2.4.17 allows a network-adjacent attacker to send a crafted SNMP response to the CUPS SNMP backend, causing an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This is fixed in 2.4.17.

In Astro prior to 6.1.6, the defineScriptVars function in the server-side rendering pipeline uses a case-sensitive regex /<\/script>/g to sanitize values injected into inline <script> tags via the define:vars directive. HTML parsers close <script> elements case-insensitively and also accept whitespace or / before the closing >, allowing an attacker to bypass sanitization with payloads like </Script>, </script >, or </script/> and inject arbitrary HTML/JavaScript. This vulnerability is fixed in 6.1.6.

A client-side authorization flaw in Lightspeed Systems Classroom v5.2.1.1763770643 allows unauthenticated attackers to impersonate users by bypassing integrity checks and abusing client-generated authorization tokens, leading to unauthorized control and monitoring of student devices.

A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low-privileged 'student' user can access unauthorized course-level information by modifying intercepted API requests. Changing a captured POST request to a GET request against the /rest/v1/course PostgREST endpoint results in disclosure of sensitive information including other students' details, tutor/admin profiles, and internal course metadata.

In Mahara before 24.04.10 and 25 before 25.04.1, an institution administrator or institution support administrator on a multi-tenanted site can masquerade as an institution member in an institution for which they are not an administrator, if they also have the 'Site staff' role.

bookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket connection by guessing a URL. The issue involves inadequate access control to server resources.

In the Linux kernel, the rt2x00usb wifi driver ties device-managed resources (devres) to the parent USB device instead of the USB interface. This causes memory leaks when the driver is unbound without the device being physically disconnected, e.g. on probe deferral or configuration changes.

An information leak was discovered in the build_report() function in the xfrm_user subsystem of the Linux kernel. The xfrm_user_report structure contains unzeroed padding bytes that are copied to userspace, potentially exposing kernel memory.

A vulnerability in the Linux kernel's rfkill mechanism allows userspace to create an unlimited number of rfkill events without consuming them from the file descriptor, potentially leading to an out-of-memory condition.

In the Linux kernel, a vulnerability in the build_polexpire() function of the xfrm subsystem fails to clear trailing padding bytes after the 'hard' field in the xfrm_user_polexpire structure, leaking uninitialized heap memory to userspace via netlink multicast.