CVE Vulnerability Catalog

Lektor 3.3.14 and 3.4.0b15 contains a CSRF vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions such as writing files, deleting pages, wiping build output, and triggering publication, by sending requests from malicious web pages.

Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps in its WebSocket handler. A remote attacker can open multiple WebSocket connections and send messages in a loop, causing a Go runtime data race that crashes the process, requiring operator intervention.

Tapo C120 v1 and C200 v5 cameras have a NULL pointer dereference vulnerability in the HTTPS onboarding connect request parser. The interface is reachable without authentication after initial setup and does not validate the presence of a password field for certain parameter combinations, allowing a malformed request from the local network to crash the HTTPS service.

AWS security-agent-mcp-server before version 0.2.0 has an argument injection vulnerability in the diff scan operation, which could allow an attacker to create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory via a crafted reference value.

Tapo C120 v1 and C200 v5 cameras do not enforce authentication for HTTPS onboarding connect actions after initial setup. An unauthenticated adjacent attacker can submit unauthorized wireless configuration parameters, causing the camera to attempt connection to a different network.

djehuty prior to version 26.3.2 contains a SPARQL injection vulnerability in search/listing queries through three parameters. An unauthenticated attacker can execute read queries, allowing cross-graph data exfiltration (e.g., private data) and denial-of-service via expensive or malformed queries.

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. An attacker who can have a Smile document parsed may embed a property name of unbounded length, causing memory exhaustion and denial of service. This issue also affects the CBOR parser and is tracked in advisory GHSA-3v8f-v6vx-fmrm.

The CBOR parser in FasterXML jackson-dataformats-binary does not enforce the maxNameLength limit for JSON object property names, allowing processing of names of unbounded length. An attacker can submit a CBOR document with an extremely long property name, leading to memory exhaustion and denial of service. The vulnerability is specific to binary formats and does not affect the standard JSON parser in jackson-core.

An improper privilege management vulnerability (CWE-269) exists in the command shell of Wind River VxWorks 7 when configured to enforce per-user command privileges. Under certain shell operations, a command may be evaluated without the normally applied privilege check, allowing an authenticated user with limited privileges to execute commands they are not authorized to run. The issue affects all versions of VxWorks 7 prior to 26.09 and has been fixed in 26.09.

Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service that becomes accessible after a reboot, and submit crafted input to execute arbitrary commands within the device management process.

TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary operating system commands.

A flaw in Foreman allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the server. By manipulating the permitted methods list in the template rendering engine, an attacker can bypass the safemode sandbox and execute unauthorized commands.

Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.

djehuty, a research data repository system, prior to version 26.3.2, allows an authenticated depositor to inject arbitrary SPARQL into a state-modifying (DELETE/INSERT) query by supplying a crafted session name, letting them write and delete arbitrary triples anywhere in the RDF store. This compromises the integrity of the whole repository's metadata.

A use after free exists in mod_auth_digest in Apache HTTP Server before 2.4.69 on all platforms. An unauthenticated remote client can cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.

Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0.

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.68.

A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails.

Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default.

In mod_proxy_ftp of Apache HTTP Server through 2.4.68, improper validation of the PASV reply address allows an untrusted FTP server, in forward proxy configurations, to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.