CVE Vulnerability Catalog

A flaw was found in Quarkus Cache Runtime. When request processing uses a Uni cached with @CacheResult and the cached Uni reuses the initial 'completion' context, the processing switches to the cached Uni instead of the request context. This can allow a malicious user to receive a response meant for another user, gaining access to sensitive data.

Mattermost groups calls in the /metrics endpoint by id and reports that id in the response. Since this id is the channelID, the public /metrics endpoint is revealing channelIDs.

A stored cross-site scripting (XSS) vulnerability was discovered in DaiCuo version 2.5.15 in the /admin.php file. Attackers can inject malicious JavaScript or HTML via crafted input.

In MISP before version 2.4.179, there is an XSS vulnerability in the event timeline widget located in app/Lib/Tools/EventTimelineTool.php.

The vulnerability in aiohttp allows an attacker to modify the HTTP request through improper validation, potentially leading to header injection or the creation of new requests if the attacker controls the HTTP method.

CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in allowlisted_content_type? determines Content-Type permissions by performing a partial match. If the content_type argument is crafted by an attacker, Content-Types not included in the allowlist will be allowed. This issue has been patched in versions 2.2.5 and 3.0.5.

Using an invalid public key to create an x509 certificate via the crypto.X509Certificate() API causes an unexpected termination, making it susceptible to DoS attacks. The vulnerability affects all active Node.js versions v16, v18, and v20.

A vulnerability was found where response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from those with correct PKCS#1 v1.5 padding. Timing differences may enable a side-channel attack.

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.

A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.

A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function.

A use-after-free vulnerability exists in BusyBox v1.36.1 in the evaluate function in awk.c. An attacker can cause a denial of service via a crafted awk pattern.

A use-after-free vulnerability was discovered in the xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.

Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint, allowing an attacker who is a guest user and knows the ID of another user to obtain their information (e.g., name, surname, nickname) via Mattermost Boards.

Mattermost fails to limit the log size of server logs, allowing an attacker to send specially crafted requests to different endpoints and potentially overflow the log.

Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards, allowing an attacker to consume excessive resources, possibly leading to Denial of Service, by importing a board using a specially crafted zip (zip bomb).

Mattermost fails to properly check a redirect URL parameter, allowing an open redirect when the user clicked "Back to Mattermost" after providing an invalid custom URL scheme in /oauth/{service}/mobile_login?redirect_to=.

Mattermost fails to properly validate the "Show Full Name" option in some Mattermost Boards endpoints. A member can obtain another user's full name even if the option was disabled.

Mattermost fails to check whether the “Allow users to view archived channels” setting is enabled during permalink previews display. As a result, members can view permalink previews of archived channels even if the setting is disabled.