CVE Vulnerability Catalog

In Eclipse Vert.x versions [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9], and 5.2.0, the vertx-mail-client does not sanitize CR/LF characters in user-supplied email header names and values before writing them to the SMTP DATA section. Injecting CR/LF sequences allows adding arbitrary headers (e.g., Bcc, Reply-To) or prepending body content; the same weakness affects MIME part metadata.

Eclipse Vert.x Web versions [4.0.0,4.5.34], [5.0.0,5.0.12], [5.1.0,5.1.9], and [5.2.0,5.2.0] contain a scope bypass vulnerability in ChainAuthHandler when used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. When a user is already authenticated by a preceding handler, ChainAuthHandler skips all scope validation configured via withScope() or withScopes().

In BentoPDF through 2.8.6, cloudflare/cors-proxy-worker.js performs a DNS-over-HTTPS safety check in hostnameResolvesToPrivate() separately from the outbound fetch. In deployments without PROXY_SECRET validation, an attacker controlling authoritative DNS can forge the Origin header and supply a certificate, OCSP, CRL, or TSA URL that passes path checks, returning a public address during validation and a private one during the later fetch.

dbt versions 2.0.0-alpha.0 through 2.0.0-alpha.5 expose an unauthenticated POST /api/v1/query endpoint in dbt docs serve, which passes caller-supplied SQL to DuckDbViewsBackend::query_arrow() without authorization or an allowlist. A client that can reach the server can invoke DuckDB filesystem-reading functions to read files available to the dbt process, including files outside the docs index directory.

In F´ (F Prime) prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because a wrapping sum bypasses the range check, becomes m_endOffset, and leaves m_byteOffset greater than the wrapped end offset. When an existing source file is larger than the supplied startOffset and a length causes the U32 sum to wrap, the first data-packet send reaches FW_ASSERT and aborts or resets the process.

In F´ (F Prime) prior to 4.3.0, Svc::TlmPacketizer TlmRecv_handler copies val.getSize bytes into fixed-slot entry.channelSize storage without confirming the runtime value fits. When a telemetry update for a configured channel carries a larger serialized value, it overwrites adjacent channel fields and emits corrupted packetized telemetry.

F´ (F Prime) before version 4.2.0 has a vulnerability in the Svc::FpySequencer STORE directive stack write validation. The bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound to make an out-of-range destination appear valid.

In F´ (F Prime) prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because unchecked startOffset plus length arithmetic bypasses the range check and stores a wrapped m_endOffset inconsistent with m_byteOffset. When the source file is larger than a valid startOffset and a length causes the U32 sum to wrap below the file size, the first data-packet transition reaches FW_ASSERT and aborts or resets the process.

In F´ (F Prime) prior to 4.3.0, Svc::EventManager loqQueue_internalInterfaceHandler packetization is vulnerable because EventManager accepts up to the LogBuffer maximum, but packet descriptor, event identifier, and time-tag metadata consume part of the larger ComBuffer, leaving a smaller budget for log arguments; serialization failure then reaches an assertion. When a deployment bridges events through GenericHub into EventManager and forwards a legal Fw::LogBuffer larger than the remaining budget, standard assertion handling aborts or resets the process.

F´ (F Prime) before version 4.2.0 has a vulnerability in Fw::FilePacket deserialization used by Svc::FileUplink. Header deserialization casts the byte to the Type enum without validating its range, and FilePacket::fromSerialBuffer reaches a default FW_ASSERT when a network file packet contains an unknown file-packet type byte.

F´ (F Prime) before version 4.2.0 has a vulnerability in Svc::FileUplink handleDataPacket offset and size validation. The component checks byteOffset plus dataSize with wrapping U32 arithmetic and then seeks to the large attacker-controlled offset before writing.

In F´ (F Prime) from 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is passed to serialOut_out, bufferOut_out, eventOut_out, or tlmOut_out without an explicit range check. When a remote hub packet supplies a port index outside the configured output-port array, assert-enabled builds abort, while builds without assertions can access an output-port array out of bounds, corrupt heap memory, and potentially allow remote code execution.

F´ (F Prime) before version 4.2.0 has a vulnerability in Svc::GenericHub fromBufferDriver_handler deserialization. The receive handler uses FW_ASSERT for externally influenced deserialization status and type validation and permits a command payload size subtraction to underflow.

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption.

A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks and missing length checks on the RSA path can overflow a host buffer in the vhost-crypto backend.

A flaw in DPDK lib/vhost vhost-crypto causes the indirect-descriptor snapshot to double-fetch a guest descriptor next index. A malicious guest can exploit this to cause an out-of-bounds access in the host backend.

A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash.

A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend.

A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.