CVE Vulnerability Catalog

In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface FIFOs under a predictable path derived from the agent name and a hash of the workload configuration. If the path already exists at agent startup, it is reused without validating owner or permissions, allowing a local user to impersonate the workload and modify cluster state.

A double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.

A race condition due to improper synchronization of a shared resource in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.

In the blaze Scala library prior to 0.23.18 and from 1.0.0-M1 to 1.0.0-M42, the hand-written HTTP/1.1 parser accepts invalid header names, obsolete folded lines, unsupported Transfer-Encoding values, duplicate Content-Length fields, and requests with both Transfer-Encoding and Content-Length. Parser disagreement with a fronting intermediary can enable authorization bypass, response-queue poisoning, or cache poisoning.

In the Pay library (Ruby on Rails) prior to 11.6.2, Pay::Webhooks::PaddleBillingController compares the SHA-256 HMAC with the attacker-controlled h1 token from the Paddle-Signature header using String#==, allowing an attacker to recover a valid signature via timing measurements. A forged webhook can alter billing state, provision paid features, or trigger notifications.

In DotVVM prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route with multiple unconstrained parameters in one path segment can cause excessive regex backtracking in DotvvmRoute.IsMatch when a long near-match path is supplied. The lack of a matching timeout in DotvvmRouteParser.RouteRegex leads to resource exhaustion.

In LangChain MongoDB integrations prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, MongoDBSaver.list(), alist(), and MongoDBStore.search() incorporate filter dictionaries into MongoDB queries without rejecting keys prefixed with $. An authenticated caller controlling a filter can inject MongoDB operators such as $regex or $where, bypassing tenant isolation.

In flat-to-nested prior to 1.1.2, FlatToNested.prototype.convert in index.js uses attacker-influenced id and parent fields as keys in temp and pendingChildOf objects. When parent or id is __proto__, prototype pollution occurs, potentially causing application-logic corruption, denial of service, or further exploitation.

In Flask-Reuploaded from 1.5.0 until 1.6.0, UploadSet.save(storage, name=...) applies lowercase_ext to the default path but uses the case-preserving extension helper for a caller-supplied name before extension_allowed evaluates an AllExcept denylist. An attacker can bypass a lowercase denylist with a mixed-case dangerous extension and store the file in the served upload directory.

In backpack/crud before 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest builds a shell command with a URL influenced by the HTTP Host header and passes it to exec() without adequate shell neutralization. An unauthenticated attacker can inject OS commands when exec() and curl are available and the 1-in-100 random gate is reached (repeated requests can hit it). Successful exploitation executes commands as the web-server user.

In backpack/crud from 6.0.0 until 6.8.14 and 7.0.38, the Update, Delete, and Reorder operations resolve records from the unscoped model query instead of the query configured through addClause() or addBaseClause(). An authenticated user who knows or guesses an out-of-scope record primary key can modify, delete, or reorder records hidden by tenant, ownership, or other row-level access-control scopes.

In backpack/crud before 6.8.12 and 7.0.35, HasUploadFields::uploadMultipleFilesToDisk trusts disk-relative paths from clear_<attribute>[] and passes them to Storage::disk()->delete without confirming that the paths are persisted on the current model record. An authenticated user with Update access to a CRUD using this mutator can delete another record's attachment, a shared asset, or another operational file on the configured disk.

In backpack/crud before 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm passes request data from $request->except(['_token']) to the user model instead of restricting updates to fields accepted by AccountInfoRequest::validationData(). An attacker with an authenticated Backpack session can mass-assign password, the authentication column, or other deployment-specific fillable attributes.

In EasyAdmin from 5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable uploads while templates/crud/field/file.html.twig links to stored files for inline same-origin rendering without a download attribute or Content-Disposition attachment header. When uploads are stored under the public web root, an attacker can upload HTML through FileField or SVG through ImageField, and JavaScript executes in an authenticated administrator's origin.

In docx4j before 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed DOCX containing mutually based styles causes unbounded recursion in PropertyResolver.fillPPrStack and related effective-style resolution paths, resulting in StackOverflowError.

In http4k before 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip request-body decompression functions impose no limit on decompressed size. An unauthenticated client can send a small gzip-encoded request body that expands to gigabytes, exhausting the JVM heap.

In dd-trace-rb before 2.32.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) or DD_TRACE_BAGGAGE_MAX_BYTES (default 8192), although those limits apply during baggage injection. A remote unauthenticated attacker can send a baggage HTTP header containing many comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption.

In dd-trace-java before 1.62.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) or DD_TRACE_BAGGAGE_MAX_BYTES (default 8192), although those limits apply during baggage injection. A remote unauthenticated attacker can send a baggage HTTP header containing many comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption.

In Conform from 1.8.0 until 1.19.4, the parseSubmission future API in packages/conform-dom/formdata.ts repeatedly scans FormData or URLSearchParams entries by each unique field name. An unauthenticated attacker can submit a crafted form containing many unique names, causing excessive synchronous CPU work and denial of service.

In XWiki Platform prior to 17.10.5 and 18.2.0, the /skin/ action in SkinAction can resolve double-encoded parent-directory segments outside the intended resource prefix when Jetty 12 or later decodes the request path. An unauthenticated remote attacker can read arbitrary resources permitted to the Jetty process, including WEB-INF/xwiki.cfg and potentially host files. The issue is fixed in versions 17.10.5 and 18.2.0.