CVE Vulnerability Catalog

In Nuxt from 3.0.0 until 4.6.3, the development server can expose the Nitro 2 development bundle at <buildDir>/dev/index.mjs through Vite file serving when the server is reachable over HTTP. Nitro inlines private runtimeConfig values resolved at build time into that bundle, including secrets configured in nuxt.config, and Nuxt 4.6.0 and later also inline the generated development appSecret. The default localhost binding limits remote exposure, production builds and Nitro 3 are not affected, and runtime configuration supplied only through NUXT_* environment variables at server startup is not inlined. This is fixed in version 4.6.3.

In Nuxt from 4.6.0 until 4.6.3, a client with TCP access to an exposed Nuxt development server can send a nuxt:dev:client-error event over the HMR socket with an absolute file path at the end of its message. The development server reads that file while building the client error report and returns its contents through the error overlay, development error channel, and terminal report, bypassing Vite's server.fs allow list. The default localhost binding limits remote exposure, cross-origin browser requests are rejected, production builds and Nuxt 3 are not affected, and no browser interaction is required. This is fixed in version 4.6.3.

A flaw in the openshift-ansible installer container's `run` script causes remote inventory and dynamic scripts to be downloaded and executed without integrity verification. A remote attacker performing a Man-in-the-Middle attack or compromising the HTTP server providing these scripts could substitute an arbitrary executable, which would then run with the installer's UID and full cluster-provisioning privileges.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

In IDrive Backup for Windows version 7.0.1.1 and below, a local attacker can execute arbitrary code via the id_service.exe component. This is remediated in version 7.0.1.2.

In IDrive Backup for Windows version 7.0.1.1 and below, a local attacker can execute arbitrary code via the id_service.exe component. This is remediated in version 7.0.1.2.

In pyasn1 prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 with large mantissas causes quadratic decode time, holding a decoding worker on one CPU core for seconds or longer and causing availability loss.

In pyasn1 prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input with many constructed BIT STRING fragments causes quadratic CPU work during decode().

In pyasn1 prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data with many fragments causes quadratic CPU work during decode().

In pyasn1 from 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input with many distinct long tag IDs whose TagSet hashes collide causes quadratic CPU work during decoding.

In PHPUnit from 13.4.0 until 13.4.4, TestCase::coverageFilesDirectory() creates temporary files for PHPT code coverage in a predictable phpunit-phpt directory under sys_get_temp_dir() and reuses that directory without verifying its ownership or permissions. On multi-user systems with a shared temporary path, a local attacker who creates the directory before the developer runs PHPT tests with code coverage can replace the generated job file before the child process executes it with require, allowing arbitrary code execution with the developer's privileges.

In node-forge prior to 1.4.1, ASN.1 decoding inside BIT STRING values did not consistently apply the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer().

In node-forge prior to 1.4.1, deprecated extension OIDs 2.5.29.10 and 2.5.29.13 were parsed as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. If a trusted CA issues a certificate carrying an attacker-supplied deprecated-OID extension before the genuine basicConstraints extension, the certificate holder could have the certificate accepted as a CA and issue certificates for arbitrary names.

Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when the certificate also carried a keyUsage extension. An attacker holding that CA's private key or a subordinate CA certificate could construct a chain exceeding the declared path length that still passed pki.verifyCertificateChain(). This is fixed in version 1.4.1.

In node-forge prior to 1.4.1, forge.tls.createConnection() continued processing after a TLS record of another content type interrupted a fragmented handshake message. A remote peer could trigger an uncaught TypeError in process(), causing the connection or hosting process to fail.

In node-forge prior to 1.4.1, received TLS records were processed recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service.

Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength option passed to start() during decryption via forge.cipher.createDecipher(). When an application derived tagLength from received data or used an unset or zero-like value, and the authentication tag was empty or missing, decipher.finish() accepted unauthenticated ciphertext. This is fixed in version 1.4.1.

A heap-based buffer overflow exists in the vtkWindBladeReader FindVariableOffsets functionality of VTK version 9.6.1. A specially crafted .wind file can trigger a buffer overflow.

An out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of VTK version 9.6.1. A specially crafted chaco file can trigger an out-of-bounds read.