CVE Vulnerability Catalog

WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 have a missing authorization vulnerability (CWE-862) in the cluster expansion functions gp_expand_lock_catalog() and gp_expand_bump_version(). Any authenticated database role can run them without privilege checks, allowing catalog changes to be blocked cluster-wide or sessions with temporary tables to be repeatedly disconnected.

WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE-862) in the built-in function gp_log_backend_memory_contexts(). Any authenticated database role can run this function without a GRANT, bypassing the superuser restriction PostgreSQL places on the underlying pg_log_backend_memory_contexts() function. A low-privileged user can force segment backends of any other session, including superuser sessions, to write memory context details to segment server logs, which may include query text from other users' cached plans.

An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.

A NULL pointer dereference in the dasher_insert_timeline_entry function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-4 file.

The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account management operations such as password reset, role change, or sub-organization disablement. As a result, previously issued tokens remain active even after the user's access context has been modified or revoked.

When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabling enumeration of valid usernames in the external user store.

The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging, potentially exposing confidential information.

Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This oversight permits attackers to bypass the intended protection mechanism.

The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint.

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages, which can be used in conjunction with social engineering techniques to trick users into interacting with malicious links, potentially resulting in phishing attacks.

A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "named". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid, and by also sending crafted queries to a zone the attacker controls, may potentially achieve remote code execution.

The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A packet with declared zero payload length passes the frame-length check, after which the parser reads the response type byte via an unbounded 5-byte fetch that returns nullptr, causing type = p[4] to dereference it and crash the client process.

A vulnerability in the Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that they are objects. A malformed Discovery response whose data/service members or instances list contain non-object entries triggers an out-of-bounds read and potentially crashes the bRPC client.

On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service exemption on internal_port can be abused to bypass authentication entirely. Verification runs only for the first message of a connection and the result latches the connection, so a request such as GET /status to internal_port authenticates the whole connection.

Apache bRPC versions before 1.18.0 expose builtin /flags and /pprof services that allow a remote attacker to change dump paths (bvar_dump_file, bvar_dump_tabs, mbvar_dump_file) and create directories or overwrite files with the server process privileges. Additionally, the ?seconds= parameter in /pprof is not clamped, enabling an attacker to hold the process-wide CPU profiler for an arbitrarily long time.

HTTP request/response smuggling vulnerability in Apache bRPC versions < 1.18.0 stems from inconsistent HTTP/1.1 header parsing in its bundled parser. bRPC accepts malformed header forms (space before colon, spaces in Content-Length values, obs-fold, chunked trailers merged as headers, Transfer-Encoding lists with whitespace), allowing attackers to smuggle requests or headers when bRPC is deployed behind a proxy or load balancer.

Improper authorization in Apache bRPC (versions < 1.18.0) allows remote attackers to access builtin services through the public port. Protobuf-based protocol dispatch paths computed but did not enforce the security_mode flag, allowing invocation of services such as brpc.vars or hotspots.