CVE Vulnerability Catalog

JupyterLab from version 4.5.0 to 4.5.10 and 4.6.2 has a vulnerability in the PyPI extension manager. The enforcement of blocked_extensions_uris uses weaker normalization than PyPI package-name canonicalization. An authenticated user can request a PyPI-equivalent spelling such as JupyterLab.Git for a blocklisted package such as jupyterlab-git, bypassing the blocklist.

Budibase prior to version 3.39.25 has a vulnerability in the GET /api/users/metadata and GET /api/users/metadata/:id endpoints. Responses include user objects without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role can retrieve identity-provider credentials of SSO-authenticated users and use refresh tokens for persistent access to connected services.

streama has an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users' Continue Watching dashboards by supplying arbitrary primary keys without ownership verification.

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

A vulnerability in EnzoVezzaro mcp-dominican-layer up to version 39dd373786712650097ad31db27d5c477c8f9c82 affects the parse-pdf function in src/index.ts of the PDF Parsing component. Manipulation of the pdfUrl argument leads to server-side request forgery. The attack can be launched remotely, and the exploit has been publicly disclosed.

A server-side request forgery (SSRF) vulnerability was found in the parse-csv tool of the EnzoVezzaro mcp-dominican-layer project, in the axios.get function in src/index.ts. The attack can be carried out remotely, and an exploit has been published. The project uses a rolling release strategy, so specific versions are not provided.

The gdu tool fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects.

Worksuite SaaS versions prior to 6.0.14 contain a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administrators to inject arbitrary JavaScript by entering malicious payloads into the Location and Description fields when creating a new asset. Stored scripts execute automatically in the browsers of any user who views the affected asset, potentially leading to session hijacking, credential theft, and unauthorized actions.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper processing of XML external entities.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to force a NetServer server thread exception, caused by an integer overflow during bounds checking in request processing. The attacker could exploit this vulnerability to cause a temporary denial of service.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code or cause a denial of service due to improper bounds checking.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to a byte-count and element-count confusion.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an off-by-one error in bounds checking.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an improper buffer write.

IBM Documentation Offline versions 1.0.0 through 1.4.1 could allow a remote attacker to forge valid session tokens due to the use of a hardcoded cryptographic key.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain sensitive information or modify data due to improper privilege management.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information or cause a denial of service due to an out-of-bounds read.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an integer error when processing DRDA large-object headers.