CVE Vulnerability Catalog

IBM MQ improperly validates cluster command message lengths. An authenticated attacker with cluster access could cause a denial of service or potentially execute arbitrary code.

IBM MQ Java and JMS client libraries contain a deserialization filter bypass in exception handling. An authenticated attacker could execute arbitrary code on client applications.

IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40 contain an integer overflow in MQINQ request validation. An authenticated attacker could cause a denial of service or potentially escalate privileges.

IBM MQ contains a heap buffer overflow when processing MQPUT operations with malformed distribution headers. An authenticated attacker could cause a denial of service or potentially escalate privileges.

IBM MQ Console contains improper authorization checks that allow authenticated non-administrative users to create and start queue managers.

IBM MQ contains a buffer overflow when processing malformed compressed data on channels configured with compression enabled. A remote attacker could cause a denial of service or execute arbitrary code.

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Versions starting in 3.1.0 and prior to 7.0.0 insert the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext. Version 7.0.0 patches the issue.

IBM Cloud Pak for Data 5.1.2 contains improper validation of user-supplied input. An authenticated user could execute arbitrary commands with elevated privileges on the system.

IBM Cloud Pak for Data 5.1.2 allows a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

Concrete CMS Community Store before version 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts or exfiltrate data.

uutils coreutils before version 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems.

hickory-resolver before version 0.26.2 fails to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.

Integer overflow in µD3TN v0.15.0 TCPCLv3 handshake causes heap overflow, allowing remote attackers to reliably cause DoS.

A flaw in Netty netty-codec-smtp is the improper validation of Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP commands, leading to SMTP command smuggling.

A flaw in Netty's HTTP/1 to HTTP/2 conversion process occurs when an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header. Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority.

A flaw in Netty causes specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests to be incorrectly processed as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information.

A flaw in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can supply a different Host header, producing a malformed HTTP/2 CONNECT request.

A flaw in Netty's RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in RTSP requests. A remote attacker can send a specially crafted RTSP request, leading to method-token smuggling.

A flaw in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This leads to memory exhaustion.

A flaw in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can use HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to unbounded growth of a per-connection queue and excessive memory consumption.