CVE Vulnerability Catalog

In OpenAM prior to 16.1.1, the Cross-Domain Single Sign-On (CDSSO) servlet allows a logged-in user's raw session token to be POSTed to an attacker-controlled URL. An attacker can induce an authenticated victim to visit a crafted URL and capture the session credential.

In GraphQL-core from 3.3.0a3 until 3.3.1, validate() reuses a module-level ValidationAbortedError when a document exceeds max_errors. Python appends frames to the reused exception's traceback on every raise, retaining each document, validation context, and error set for the process lifetime.

In joserfc prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization recipients array without a count limit and calls decrypt_cek() for every entry. An unauthenticated attacker can control the number of private-key decryption operations performed by one request.

In Nx from 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin options from nx.json into command arguments. The @nx/maven targetNamePrefix value and arbitrary @nx/gradle option names or values can be interpreted as shell syntax.

The dbt Cloud webhook in Lightdash (POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook) has no authentication middleware or signature validation. The accountId and runId values from the request are interpolated into the server-side dbt Cloud API URL, enabling path traversal and a credential-bearing request using the victim project's API key.

HashiCorp Boundary and Boundary Enterprise are vulnerable to SSRF in the Vault credential store integration. An authenticated user with permission to manage credential stores can cause the Boundary controller to issue outbound requests to a network destination of their choosing and receive the response.

Bricks Theme 2.4 and earlier for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint. An anonymous attacker can read draft and unpublished page content by supplying a popupId parameter without any status or capability checks.

@hapi/content from 3.0.6 until 6.0.3 uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching when a Content-Disposition parameter contains a long token without an equals sign. The resulting quadratic processing can block the Node.js event loop before route handlers, including unauthenticated hapi routes with payload.multipart enabled.

A flaw in the openshift-ansible installer container's `run` script causes remote inventory and dynamic scripts to be downloaded and executed without integrity verification. A remote attacker performing a Man-in-the-Middle attack or compromising the HTTP server providing these scripts could substitute an arbitrary executable, which would then run with the installer's UID and full cluster-provisioning privileges.

In IDrive Backup for Windows version 7.0.1.1 and below, a local attacker can execute arbitrary code via the id_service.exe component. This is remediated in version 7.0.1.2.

In IDrive Backup for Windows version 7.0.1.1 and below, a local attacker can execute arbitrary code via the id_service.exe component. This is remediated in version 7.0.1.2.

In pyasn1 prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 with large mantissas causes quadratic decode time, holding a decoding worker on one CPU core for seconds or longer and causing availability loss.

In pyasn1 prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input with many constructed BIT STRING fragments causes quadratic CPU work during decode().

In pyasn1 prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data with many fragments causes quadratic CPU work during decode().

In pyasn1 from 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input with many distinct long tag IDs whose TagSet hashes collide causes quadratic CPU work during decoding.

In node-forge prior to 1.4.1, ASN.1 decoding inside BIT STRING values did not consistently apply the configured maxDepth limit and recursively retained copies at each nesting level. Crafted DER containing nested BIT STRINGs could cause excessive recursion, CPU use, and quadratic memory consumption during asn1.fromDer().

In node-forge prior to 1.4.1, deprecated extension OIDs 2.5.29.10 and 2.5.29.13 were parsed as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. If a trusted CA issues a certificate carrying an attacker-supplied deprecated-OID extension before the genuine basicConstraints extension, the certificate holder could have the certificate accepted as a CA and issue certificates for arbitrary names.

In node-forge prior to 1.4.1, forge.tls.createConnection() continued processing after a TLS record of another content type interrupted a fragmented handshake message. A remote peer could trigger an uncaught TypeError in process(), causing the connection or hosting process to fail.

In node-forge prior to 1.4.1, received TLS records were processed recursively, consuming one JavaScript stack frame per record in a single input chunk. A remote peer could send thousands of small records together and exhaust the call stack, causing an uncaught exception and denial of service.

A heap-based buffer overflow exists in the vtkWindBladeReader FindVariableOffsets functionality of VTK version 9.6.1. A specially crafted .wind file can trigger a buffer overflow.