CVE Vulnerability Catalog

In leomoon-studios wiki-go up to 1.9.1, the SaveHandler/SourceHandler functions in internal/handlers/editor.go (API component) are vulnerable to path traversal via input manipulation. The attack can be launched remotely, and a public exploit may be used in attacks.

In leomoon-studios wiki-go up to 1.9.1, the RenameFileHandler function in internal/handlers/files.go (Files Rename API component) is vulnerable to path traversal via manipulation of the currentPath/newName arguments. The attack can be initiated remotely, and a public exploit may be used in attacks.

A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadata_api.go of the fetch-metadata Endpoint component. Such manipulation leads to server-side request forgery. The attack can be launched remotely and the exploit is publicly available.

A flaw was found in HarnessRouter up to 0.31.12 affecting an unknown function in gateway/app.py of the Targets Test Endpoint component. Manipulating the base_url argument can lead to server-side request forgery, exploitable remotely.

Django REST framework versions 3.6.4 through 3.18.2 use the client-supplied Content-Type charset value with codecs.getreader, accepting byte-transform codecs such as bz2_codec. A remote unauthenticated client can send a compressed JSON body that is expanded after DATA_UPLOAD_MAX_MEMORY_SIZE is enforced, consuming substantial per-worker memory.

Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.is_authorized(...) for the execute action on the kernels resource. A restricted authenticated user could therefore open an upstream kernel channel and obtain kernel execution despite the configured Authorizer denying that action, exposing data and credentials available to the kernel and permitting modification or disruption of the kernel environment. The default gateway configuration is fixed in version 2.6.0. In 2.6.0 and later, the same authorization bypass remains possible when a deployment manually registers the deprecated jupyter_server.gateway.handlers module, because its handler still omits the configured kernel-execute authorization decision.

Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creation of a predictably named S3 bucket that the SDK uses without ownership validation.

Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports. This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0.

Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until the connection times out, because it waits for the trailer bytes it has already dropped. Trailer dropping is on by default in 10.x. In 8.1.11 and 9.2.x it is off by default, and those versions are affected only if it is enabled. This issue affects Apache Traffic Server: 8.1.11, from 9.2.5 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.

Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy. This affects versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0.

Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This affects versions 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0.

Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. Affects versions 8.0.0–8.1.11, 9.0.0–9.2.15, 10.0.0–10.1.4, and 10.2.0.

Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. Affects versions 8.0.0–8.1.11, 9.0.0–9.2.15, 10.0.0–10.1.4, and 10.2.0.

Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains.

Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding headers. This affects versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0.

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Server from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, and 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affects versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0.

The MCTP-over-I2C+GPIO target binding (mctp_i2c_gpio_target.c) fails to clear the selected register (b->reg_addr) and data-phase flag (b->rxtx) on I2C STOP. A bus controller can use two ordinary transactions to make mctp_bus_rx() run with a NULL buffer or to dereference b->tx_pkt->end after it was cleared, triggering an exception in the I2C target interrupt handler and a device reset or halt.

The Nuvoton NPCX eSPI driver's espi_taf_parse() processes TAF requests without validating the 12-bit length field from the request header. For write and RPMC OP1 requests it copies up to 255 words into a fixed 16-word buffer in a static structure, causing an out-of-bounds write of roughly 956 bytes into .bss and reads past neighbouring eSPI registers. The same unvalidated length is passed to flash_write(), letting the host read up to 4 KB of adjacent controller SRAM.

A race condition in the Zephyr kernel affects z_waitq_head(), which on SMP systems reads the head of a thread wait queue without holding the _sched_spinlock. The race between timer expiration handling and thread abort can cause out-of-bounds and use-after-free writes in supervisor context plus scheduler state corruption.