CVE Vulnerability Catalog

HCL iControl has missing security headers, which enables cross-site scripting (XSS) attacks by disabling the built-in XSS filtering mechanisms of modern web browsers.

HCL iControl is missing critical cookie attributes like Secure and SameSite, and the path is set to root. This can lead to session hijacking or CSRF attacks.

In the PIL Image Cache Key Handler component in file swift/template/base.py of modelscope ms-swift up to version 4.2.0, a weak hash usage was detected. The attack requires local access and is difficult to exploit. The exploit has been publicly disclosed.

In PaddlePaddle FastDeploy up to version 2.4.1, the hash_features function in file fastdeploy/multimodal/hasher.py (MultimodalHasher component) uses a weak hash. The attack requires local access and is difficult. A patch with ID 374945747652a8d32965591c0c01a00c88b7067f is available.

A security flaw in gradio-app gradio 6.14.0 affects the save_audio_to_cache function of the Audio Cache Key Handler component. Manipulation leads to use of weak hash. The attack requires local access, is difficult to exploit, but the exploit is publicly available.

Vulnerability in SGLang up to version 0.5.11 in the data_hash function of the Cache Handler component causes denial of service (DoS) via a local attack with high complexity. Exploit has been published.

In mlrun up to version 1.12.0-rc3, the function mlrun.utils.helpers.calculate_dataframe_hash in file mlrun/utils/helpers.py (DataFrame Hash Handler component) uses a weak hash. The attack requires local access and is difficult. The exploit has been publicly disclosed.

In Django 5.2 before 5.2.15 and 6.0 before 6.0.6, `django.middleware.cache.UpdateCacheMiddleware` does not match `Cache-Control` response directives case-insensitively. A remote attacker can read responses that were incorrectly cached because their `Cache-Control` directives used uppercase or mixed-case values.

In Django (versions 6.0 before 6.0.6 and 5.2 before 5.2.15), `EmailBackend` fails to prevent reuse of a partially-initialized connection after a failed STARTTLS handshake when `fail_silently=True`. This allows on-path network attackers to read email content in cleartext.

Vulnerability in Django (versions 6.0 before 6.0.6 and 5.2 before 5.2.15) in the `get_signed_cookie` function allows an attacker to use a signed cookie in a different context than intended, by manipulating the cookie name and salt argument. This is due to non-injective salt derivation.

In Django 5.2 before 5.2.15 and 6.0 before 6.0.6, `django.utils.cache.has_vary_header()` does not strip leading or trailing whitespace from `Vary` response header values before comparison. This allows remote attackers to read cached responses via requests to URLs whose responses contain whitespace-padded Vary header values.

Daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 as header line separators, but autobahn decodes header values to str and calls splitlines(). An attacker can exploit this parser differential to inject additional headers into the ASGI scope passed to the application. daphne now rejects requests with these bytes in any header value with a 400 response.

In Django 5.2 before 5.2.15 and 6.0 before 6.0.6, `django.middleware.cache.UpdateCacheMiddleware` does not add `Authorization` to the `Vary` response header for requests bearing that header without `Cache-Control: public`. This allows remote attackers to read private cached responses via unauthenticated requests to the same URL.

An HTML injection vulnerability was found in Canarytokens notification emails for 'Slow Redirect' and 'Cloned Website'. It allows interface manipulation and XSS in email clients that render HTML.

The cilium ebpf library up to version 0.21.0 has a vulnerability in the loadRawSpec function in btf/btf.go. Manipulation of the offset argument leads to integer overflow. The attack requires local access.

In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited for backend request desync (request smuggling), leading to cache poisoning, authentication bypass, or information disclosure. The attack only works if HTTP/2 is enabled (disabled by default).

Dask up to version 3.0 has a vulnerability in the nunique_approx function in dask/dataframe/hyperloglog.py (HLL Handler component) that causes resource consumption. The attack is remote, with high complexity, and exploitation is difficult. A pull request with a fix is pending acceptance.

In openSeaChest v25.05.3, the --showSupportedFormats function has an out-of-bounds write. A malicious NVMe device with a bogus FLBAS byte can write 1 extra byte outside allocated memory.

In openSeaChest v25.05.3, the --showSCSIDefects function has out-of-bounds writes and reads. A malicious SCSI device with a very long defect list can write defect info out of bounds.

Vulnerability in elixir-tesla library (versions 0.8.0 before 1.18.3) allows multipart part header injection via unescaped Content-Disposition parameter values, potentially leading to header forgery and data manipulation.