CVE Vulnerability Catalog

A cross-site request forgery (CSRF) vulnerability has been reported to affect Notification Center, allowing remote attackers to gain privileges or hijack user identities.

The Espressif Internet of Things (IOT) framework has an out-of-bounds read issue in the BlueDroid AVRCP vendor-command parser. This issue affects versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0 and has been patched in versions 5.2.7, 5.3.6, 5.4.5, 5.5.4, and 6.0.1.

The ESP-IDF framework has a vulnerability in versions 5.2.7, 5.3.5, 5.4.4, 5.5.4, and 6.0.1 related to an out-of-bounds read flaw in the DHCP server option parser. This vulnerability allows reading adjacent memory, potentially leading to unauthorized access to data.

In Frappe LMS prior to version 2.53.0, an authenticated user could inject specially crafted content into user-editable fields that, when displayed in page metadata, caused visitors' browsers to navigate to an attacker-chosen URL.

BuddyPress version 14.4.0 contains an insecure direct object reference vulnerability in the friends REST API that allows authenticated attackers to enumerate another user's complete friend list.

A vulnerability in the SubjectDnX509PrincipalExtractor component of Spring Security allows incorrect handling of malformed CN values in X.509 certificates. This can lead to reading the wrong username and potentially allow an attacker to impersonate another user.

Nimiq is a Rust implementation of the Proof-of-Stake protocol. Prior to version 1.5.0, a remote peer can crash any full node by sending a RequestBatchSet message containing the genesis block's hash.

In versions prior to 1.4.0, Nimiq has a denial-of-service vulnerability in the Ed25519 multisig delinearization code path. The Ed25519PublicKey::delinearize() method calls .unwrap() on curve point decompression, which panics when a public key is not valid.

In versions prior to 1.4.0 of Nimiq, the LightBlockchain::rebranch() function does not correctly update the macro and election state after adopting a fork chain, leading to verification issues with blocks. This can cause stalls in the light client's chain progression.

In versions prior to 1.4.0, Nimiq has a logic flaw in the BlockInclusionProof::is_block_proven function that allows a MacroBlock header to be accepted as 'proven' without cryptographic verification. This issue occurs when the hop list is empty, which can be exploited by an attacker to forge transaction inclusion proofs.

FlashMQ is an MQTT broker/server that prior to version 1.26.2 allowed authorized clients to exceed the permitted write buffer over-commit, triggering an internal safeguard exception. This exception was not catchable, leading to server abort.

In versions prior to 1.4.0, the network-libp2p library in Nimiq improperly handles DHT record verification errors, potentially leading to future queries hanging indefinitely.

A vulnerability in Spring Data REST allows an attacker to pass arbitrary persistent property paths as request parameter filter keys without considering Jackson customizations before handing them to Querydsl. This could lead to unauthorized data access or data leakage.

A vulnerability in Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients.

The vulnerability in Spring Kafka concerns the retry topic infrastructure, which did not sufficiently validate user-controlled header values. A producer could send a record with a crafted retry_topic-attempts header containing an out-of-range attempt count, causing the retry topic router to misidentify the message's position in the retry sequence.

A vulnerability in Spring for Apache Kafka allows an attacker producer to unboundedly increase the consumer's heap memory usage by sending records with unique `spring.kafka.serialization.selector` header values, leading to GC thrash and OutOfMemoryError.

A vulnerability in Spring Data Commons can lead to a Denial of Service (DoS) condition when Spring Data Web Support is enabled with a Controller method using @ProjectedPayload. An attacker can send a crafted HTTP request causing excessive memory allocation.

A SpEL Injection vulnerability in Spring Data KeyValue occurs when unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. An attacker can inject malicious SpEL expressions, leading to remote code execution.

Vulnerability in Spring AMQP causes applications using RabbitConnectionFactoryBean.setUri("amqps://...") without calling setUseSSL(true) to get TLS encryption with no certificate validation and no hostname verification.

Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters.