CVE Vulnerability Catalog

Vulnerability in Apache Thrift nodejs bindings involving improper validation of specified quantity in input and allocation of resources without limits. Affects versions before 0.25.0.

Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. Lack of limits can lead to resource exhaustion. Affects versions before 0.25.0.

Uncaught exception vulnerability in Apache Thrift PHP bindings. An unhandled exception can lead to unexpected termination of the application. Affects versions before 0.25.0.

Vulnerability in Apache Thrift Dart bindings involving memory allocation with excessive size value and improper handling of length parameter inconsistency. Affects versions before 0.25.0.

Vulnerability in Apache Thrift THeaderTransport involving missing release of memory and resources after effective lifetime. Affects versions before 0.25.0.

A stack-based buffer overflow and incorrect bitwise shift of integer vulnerability exists in Apache Thrift C++ THeaderProtocol. This issue affects Apache Thrift versions before 0.25.0.

Improper validation of specified quantity in input, allocation of resources without limits or throttling, and excessive iteration vulnerability exists in Apache Thrift PHP bindings. This issue affects Apache Thrift versions before 0.25.0.

An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface could provide a specially crafted or modified firmware image, causing it to be installed on the device.

Improper handling of length parameter inconsistency, uncaught exception, inefficient algorithmic complexity, memory allocation with excessive size value, and initialization of a resource with an insecure default vulnerability exists in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D language bindings. This issue affects Apache Thrift versions before 0.25.0.

An uncontrolled recursion vulnerability exists in Apache Thrift Dart and Java ME bindings. This issue affects Apache Thrift versions before 0.25.0.

Improper handling of exceptional conditions, allocation of resources without limits or throttling, and uncaught exception vulnerability exists in Apache Thrift Java bindings. This issue affects Apache Thrift versions before 0.25.0.

Allocation of resources without limits or throttling and improper handling of length parameter inconsistency vulnerability exists in Apache Thrift Lua bindings. This issue affects Apache Thrift versions before 0.25.0.

Allocation of resources without limits or throttling and initialization of a resource with an insecure default vulnerability exists in Apache Thrift Python bindings. This issue affects Apache Thrift versions before 0.25.0.

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the 'Remove query strings from static resources' option is enabled in W3 Total Cache.

HAVELSAN Inc. Sef - AI Chatbot Platform before 2.1 has an SQL injection vulnerability due to improper neutralization of special elements in SQL commands. The product is no longer supported.

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. An LDAP server using the LDAP API (like Apache DS) may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers. This issue affects versions from 2.1.0 before 2.1.9. Users are recommended to upgrade to version 2.1.9.

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in an LDAP server that supports this algorithm will cause the server CPU to run for hours checking the credentials. A bounded cost should be enforced to avoid a server DoS. This issue affects versions from 2.1.0 before 2.1.9. Users are recommended to upgrade to version 2.1.9.

Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lead to receive data in plain text before the TLS Handshake has been completed. This issue affects versions from 2.1.0 before 2.1.9. Users are recommended to upgrade to version 2.1.9.

Stack Overflow vulnerability in Apache Directory LDAP API. Before binding, a client can send a deeply nested search filter that overflows the stack in the server's decoder. This issue affects versions from 1.2.0 before 1.2.9.

Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer (or a MITM) can send a small BER-encoded response causing a large memory allocation before any data is received, leading to OutOfMemoryError and denial of service. This issue affects versions from 1.2.0 before 1.2.9.