CVE Vulnerability Catalog

Prior to 21.14.9, virtualenv incompletely quotes the interpreter path when generating POSIX console scripts. When the path contains a space or produces a shebang longer than 127 bytes, distlib emits a /bin/sh wrapper whose double-quoted interpreter path still expands command substitutions and backticks, allowing command execution with the user's privileges when the generated launcher is later run.

In virtualenv before 21.14.9, ViaTemplateActivator._generate() removes an existing output only when Path.exists() is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write() opens pyvenv.cfg without first replacing an existing symbolic or hard link. Another local account can cause files outside the requested tree to be created or overwritten.

In virtualenv before 21.14.9, the app-data copy seeder uses shutil.copy() to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can produce files writable by another local account in a later traversable environment.

In virtualenv before 21.14.9, PipInstall._uninstall_previous_version() accepts existing seed-package metadata and _uninstall_dist() joins entries from top_level.txt and RECORD to site-packages without checking containment. When a reused destination contains distribution metadata influenced by another account, relative traversal, absolute entries, or linked parents can cause files outside the environment to be deleted.

Prior to 21.14.9, virtualenv's POSIX xonsh activation uses repr() to write printable non-ASCII data into a UTF-8 activate.xsh, which xonsh may read under a legacy multibyte codec such as GBK or Big5. A UTF-8 trail byte can then consume the backslash before an adjacent quote, allowing the literal to close and attacker-influenced statements to execute when the script is sourced.

In virtualenv prior to 21.14.9, PipInvoke.get_pip_install_cmd() handles --seeder pip --download by calling get_wheel(download=False) and allowing pip to consult the configured index, bypassing virtualenv's download_wheel() and verify_wheel_digest() path. When default-index PyPI digest comparison is enabled, an index candidate matching the bundled package and version can be selected without comparison to PyPI SHA-256 metadata.

In virtualenv before 21.14.9, the builtin creator calls ensure_dir() for executable, library, and package directories, and ensure_dir() accepts an existing symlink to a directory because exists() follows it. Interpreter creation, seed installation, and activation generation then write through the linked parent outside the requested destination.

In virtualenv prior to 21.14.9, the stdlib venv creator reads the generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can include a line-boundary character such as U+2028 to inject keys including home and include-system-site-packages, altering the configuration structure.

Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group. To remediate this issue, users should upgrade to version 0.7.2.

The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first data packet after the TCP handshake, using only LZ4 compression rather than encryption. An attacker on the network path can passively intercept and decompress this packet to reveal the plaintext JSON payload.

XERJ Console API bearer tokens can bypass the passkey-only authentication requirement and directly invoke the API-token creation endpoint, allowing unauthorized minting of persistent successor credentials.

This CVE was rejected — it was issued in error. There is no actual vulnerability to describe.

This CVE was rejected — it was issued in error. There is no actual vulnerability to describe.

This CVE was rejected — it was issued in error. There is no actual vulnerability to describe.

This CVE was rejected — it was issued in error. There is no actual vulnerability to describe.

This CVE was rejected — it was issued in error. There is no actual vulnerability to describe.

This CVE was rejected — it was issued in error. There is no actual vulnerability to describe.

This CVE was rejected — it was issued in error. No vulnerability information is available.

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting certificate creation for a user; the stored XSS is triggered only during validation by the administrator.

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting user creation; the stored XSS is triggered only during validation by the administrator.