CVE Vulnerability Catalog

A vulnerability was determined in ericc-ch copilot-api up to 0.7.0. It impacts an unknown function of the file /token of the Header Handler component. Manipulation of the Host argument can lead to reliance on reverse DNS resolution.

IBM Verify Identity Access and IBM Security Verify Access (both container and standard editions) use weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information.

IBM Guardium Data Protection 12.1 is vulnerable to cross-site scripting. This allows an administrative user to embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.

IBM Guardium Data Protection 12.1 is vulnerable to stored cross-site scripting. This allows an administrative user to embed arbitrary JavaScript code in the Web UI, altering functionality and potentially leading to credential disclosure within a trusted session.

IBM Guardium Data Protection 12.1 could allow an administrative user to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.

IBM Guardium Key Lifecycle Manager versions 4.1, 4.1.1, 4.2, 4.2.1, 5.0, and 5.1 enables privilege escalation, allowing unauthorized users to perform administrative operations after being demoted. Attackers could access sensitive data, modify system configurations, or change permissions for other users.

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic.

IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a Bypass Business Logic vulnerability in the access management control panel. The vulnerability allows bypassing access control mechanisms.

IBM Security Verify Directory (Container) 10.0.0 through 10.0.0.3 could be vulnerable to malicious file upload by not validating file type. A privileged user could upload malicious files into the system that can be sent to victims for performing further attacks against the system.

In pypdf versions prior to 6.10.2, an attacker can craft a PDF that exhausts RAM. This requires accessing an image using /FlateDecode with large size values. This is fixed in pypdf 6.10.2.

In pypdf versions prior to 6.10.2, an attacker can craft a PDF that causes long runtimes. This requires loading a PDF with a large trailer /Size value in incremental mode. This is fixed in pypdf 6.10.2.

In pypdf versions prior to 6.10.2, an attacker can craft a PDF that exhausts RAM. This requires accessing a stream compressed using /FlateDecode with a /Predictor unequal to 1 and large predictor parameters. This is fixed in pypdf 6.10.2.

In pypdf versions prior to 6.10.1, an attacker can craft a PDF that causes long runtimes. This requires cross-reference streams with wrong large /Size values or object streams with wrong large /N values. This is fixed in pypdf 6.10.1.

nimiq-transaction prior to version 1.3.0 allows UpdateValidator transactions that set a new voting key without the required proof-of-knowledge. Skipping this requirement enables BLS rogue-key attacks on key aggregation, potentially allowing an attacker to forge a quorum-looking Tendermint block justification with a single signature. Exploitability is low because it requires knowledge of the next epoch validator set chosen via VRF.

The http.cookies.Morsel.js_output() function returns an inline <script> snippet and does not neutralize the </script> sequence, allowing HTML injection. Mitigation base64-encodes the cookie value.

In nimiq-blockchain before version 1.3.0, HistoryStore::put_historic_txns uses an assert! to enforce invariants about HistoricTransaction.block_number. During history sync, a peer can influence the input passed to Blockchain::push_history_sync, and a malformed history list can violate these invariants and trigger a panic before later rejection checks run.

The nimiq-account library prior to version 1.3.0 contains a flaw in VestingContract::can_change_balance that constructs an error using self.balance - min_cap when new_balance < min_cap. If min_cap > balance, Coin::sub panics due to underflow, and an attacker can reach this state by creating a vesting contract with unvalidated total_amount. This causes node crashes during mempool admission and blocks processing.

In nimiq-libp2p prior to version 1.3.0, MessageCodec::read_request and read_response call read_to_end() on inbound substreams, so a remote peer can send only a partial frame and keep the substream open. Because Behaviour::new sets with_max_concurrent_streams(1000), the node exposes a much larger stalled-slot budget than the library default. The patch is released in v1.3.0.

Beghelli Sicuro24 SicuroWeb does not enforce a Content Security Policy, allowing unrestricted loading of external JavaScript from attacker-controlled origins. When chained with template injection and sandbox escape vulnerabilities in the same application, the lack of CSP removes the browser-enforced restriction that would otherwise block external script execution.

Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET request to the /setup page to access the exposed root_path value rendered in the HTML response.