CVE Vulnerability Catalog

OpenTelemetry dotnet versions 1.13.1 to before 1.15.2, when exporting telemetry over gRPC using OTLP, may parse a malformed server-provided grpc-status-details-bin trailer during retry handling. This could encode an extremely large length-delimited protobuf field used directly for allocation, allowing excessive memory allocation and potential denial of service (DoS).

In OpenTelemetry dotnet from 1.13.1 to before 1.15.2, when exporting telemetry to a back-end/collector over gRPC or HTTP using OTLP, an unsuccessful request (HTTP 4xx or 5xx) causes the response to be read into memory with no upper bound on bytes consumed. This could cause memory exhaustion if the endpoint is attacker-controlled or a MitM is possible and an extremely large body is returned.

DOMPurify versions prior to 3.4.0 have an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. When EXTRA_ELEMENT_HANDLING.tagCheck returns true, the FORBID_TAGS check is skipped entirely, allowing forbidden elements to survive sanitization with their attributes intact. Version 3.4.0 patches the issue.

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, SAFE_FOR_TEMPLATES strips {{...}} expressions from untrusted HTML, which works in string mode but not with RETURN_DOM or RETURN_DOM_FRAGMENT, allowing XSS via template-evaluating frameworks like Vue 2. Version 3.4.0 patches the issue.

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass: when an application uses DOMPurify.sanitize() with the default configuration (no CUSTOM_ELEMENT_HANDLING option), a prior prototype pollution gadget can inject permissive tagNameCheck and attributeNameCheck regex values into Object.prototype, causing DOMPurify to allow arbitrary custom elements with arbitrary attributes, including event handlers, through sanitization. Version 3.4.0 fixes the issue.

SSRF vulnerability in ntfy before version 2.22.0 due to an unanchored regular expression for web push endpoint URLs. This allows an attacker to send requests to internal network resources.

An API design flaw in WebKitGTK and WPE WebKit allows untrusted web content to unexpectedly perform IP connections, DNS lookups, and HTTP requests. Applications expect to use the WebPage::send-request signal handler to approve or reject all network requests. However, certain types of HTTP requests bypass this signal handler.

Multiple uses of uninitialized variables were found in libopensc, potentially leading to information disclosure or application crash. The attack requires a crafted USB device or smart card that presents specially crafted APDU responses.

In the Linux kernel, rtm_get_nexthop() used a fixed-size skb allocation (NLMSG_GOODSIZE) when querying a nexthop object via RTM_GETNEXTHOP, which is insufficient for large nexthop groups (e.g., 512 nexthops). This triggers a warning in net/ipv4/nexthop.c and can cause allocation issues. The fix allocates the size dynamically using nh_nlmsg_size() and nlmsg_new(), and adjusts nh_nlmsg_size_grp() to account for flags and NHA_FDB size.

Magepeople inc. Taxi Booking Manager for WooCommerce contains a Stored Cross-site Scripting vulnerability due to improper neutralization of input during web page generation. The issue affects versions through 2.0.0.

The Rescue Shortcodes plugin for WordPress (up to version 3.3) is vulnerable to Stored Cross-site Scripting due to improper neutralization of input during web page generation. An attacker can inject malicious script that is stored and executed in other users' browsers.

The WordPress plugin ACF Galerie 4 up to version 1.4.2 contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can gain access to functions or data that should be protected.

EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the installation directory. A local attacker can place a specially crafted DLL in this directory and achieve arbitrary code execution with highest privileges, because the affected service runs as NT AUTHORITY\SYSTEM.

Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.

A vulnerability in Libgcrypt before version 1.12.2 allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext passed to gcry_pk_decrypt.

CMS ALAYA provided by KANATA Limited contains an SQL injection vulnerability. Information stored in the database may be obtained or altered by an attacker with access to the administrative interface.

Koollab LMS contains a stored cross-site scripting (XSS) vulnerability. Successful exploitation could allow an attacker to execute arbitrary JavaScript on any user account with access to the courselet feature.

In OpenLearn, when safeMode is enabled, unapproved forum posts are hidden from the public list, but the direct post-read procedure still returns the full post to anyone with the post UUID. The issue is fixed in commit 844b2a40a69d0c4911580fe501923f0b391313ab.

SDK LangSmith dla JavaScript i Pythona przed wersjami 0.5.19 i 0.7.31 nie stosują kontroli redakcji wyjścia do zdarzeń tokenów strumieniowych. W wyniku tego, wrażliwe dane mogą być ujawnione w pełnej formie podczas strumieniowania, mimo zastosowania redakcji.

A vulnerability was identified in ByteDance verl up to 0.7.0 in the math_equal function of prime_math/grader.py. Manipulation leads to a sandbox issue. The attack can be initiated remotely, though complexity is high and exploitability is difficult; a public exploit exists.