CVE Vulnerability Catalog

In libsixel (a SIXEL encoder/decoder implementation) up to 1.8.7-r1, a wrong NULL check after an allocation call in sixel_decode_raw and sixel_decode causes a NULL pointer dereference whenever allocation fails. The check tests the address of the output parameter (always non-NULL) instead of the value returned by malloc, so on allocation failure the function continues and writes through a NULL pointer, crashing the process. The vulnerability is fixed in 1.8.7-r2.

Nuxt OG Image generates OG Images with Vue templates in Nuxt. The isBlockedUrl() denylist introduced in [email protected] is incomplete, with an incomplete IPv6 prefix list and missing redirect re-validation. This vulnerability is fixed in 6.4.9.

Podatność w SAP NetWeaver Application Server ABAP pozwala atakującemu na wstrzyknięcie niestandardowych arkuszy stylów CSS do strony internetowej serwowanej przez aplikację. W momencie, gdy użytkownik uzyskuje dostęp do dotkniętej strony lub na nią klika, wstrzyknięty CSS jest wykonywany.

A side-channel attack requiring physical presence at the TPM can lead to extraction of an Elliptic Curve Diffie-Hellman (ECDH) key. The vulnerability affects protection of cryptographic keys stored in the TPM.

Nextcloud News is an RSS/Atom feed reader. Prior to 28.3.0-beta.1, authenticated users could add feeds with URLs pointing to internal/private IP ranges or localhost, causing the Nextcloud server to make server-side HTTP requests to attacker-controlled destinations (blind SSRF).

HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters. Passing sensitive data in URLs may expose it through browser history, logs, or intermediary systems, potentially leading to unintended information disclosure under certain conditions.

HCL AION is affected by a vulnerability where certain security-related HTTP response headers are not properly configured. Absence of these headers may reduce the effectiveness of browser-based security controls.

HCL AION is affected by a vulnerability where basic authorization tokens are used for authentication. Use of basic authorization mechanisms may expose credentials to potential interception or misuse, especially if not combined with secure transmission practices.

HCL AION is affected by a vulnerability where auto-complete functionality is enabled for certain input fields. This may allow sensitive information to be stored in the browser, potentially leading to unintended exposure under specific conditions.

Improper management of the idle timeout parameter in the Keycloak interface of the Arqit SKA-Platform enables an attacker to impersonate an authenticated tenant user via an unexpired browser session. This issue affects Symmetric Key Agreement Platform before 26.03.

W Zoom Workplace dla iOS przed wersją 7.0.0 występuje błąd w mechanizmie ochrony, który może pozwolić uwierzytelnionemu użytkownikowi na ujawnienie informacji poprzez fizyczny dostęp do urządzenia.

A vulnerability in Palo Alto Networks Broker VM allows an authenticated administrator to inject arbitrary content into certain Broker VM fields.

In Next.js from 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments relying on shared caches with insufficient response partitioning. Collisions in the _rsc cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL.

Next.js in versions 12.2.0 through 15.5.15 and 16.2.4 allows an external client to send an x-nextjs-data header on a normal request to a path handled by middleware that returns a redirect. The middleware may treat the request as a data request and replace the Location header with the internal x-nextjs-redirect header, which browsers do not follow. If the application is behind a CDN or reverse proxy caching 3xx responses without varying on this header, a single attacker request can poison the cache and cause denial of service for that redirect path.

In Hono prior to 4.12.18, improper validation of JWT NumericDate claims (exp, nbf, iat) in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This is not exploitable by an anonymous attacker; it manifests when a malformed claim value reaches verify(), typically when the application itself issues such tokens or the signing key is under attacker control.

When schema validation is enabled on a MongoDB collection and an update or insert violates the collection's schema, the generated local server log message may not have all user data redacted. This affects MongoDB Server v7.0 before 7.0.34, v8.0 before 8.0.23, v8.2 before 8.2.9 and v8.3 before 8.3.2.

Flowsint is an open-source OSINT graph exploration tool. Prior to 1.2.3, an adversary with knowledge of an investigation ID could update the metadata of another user's investigation. This vulnerability is fixed in 1.2.3.

In Micronaut Framework prior to 4.10.22, the bundleCache is keyed by (Locale, baseName), where the locale originates from the HTTP Accept-Language header. In applications that explicitly register a ResourceBundleMessageSource bean and serve HTML error responses, an unauthenticated attacker can exhaust heap memory by sending requests with many unique Accept-Language values, each creating a new entry in the unbounded bundleCache.

ciguard is a static security auditor for CI/CD pipelines. From 0.8.0 to 0.8.1, the discover_pipeline_files() function in src/ciguard/discovery.py walks a directory tree following symlinks, with cycle protection via tracking visited resolved paths. An attacker who can plant a symlink in a scanned directory can cause discovery to walk into the symlink target and return paths to pipeline-shaped files outside the requested root. This vulnerability is fixed in 0.8.2.

ciguard, a static security auditor for CI/CD pipelines, in versions 0.6.0 through 0.8.1 calls json.loads on HTTP responses without a maximum-bytes cap. A hostile or compromised endoflife.date/OSV.dev server (or a successful MITM) could return a multi-GB response, exhausting the ciguard process's memory.