CVE Vulnerability Catalog

Aedes MQTT broker prior to 1.1.1 does not bound topic depth or structural complexity before passing topics through `mqemitter` into `qlobber`. A `PUBLISH`, `SUBSCRIBE`, or registered `Will` message with an excessively deep topic triggers an uncaught `too many words` exception that escapes to the Node.js event loop and terminates the broker process. The issue is fixed in version 1.1.1.

IXP Manager prior to version 7.3.0 allows an authenticated, non-administrative user to elevate privileges to administrator status. Restricting administrative functions reduces exposure but is not a complete fix. The issue is fixed in version 7.3.0.

IXP Manager prior to version 7.3.0 allows an authenticated user to view and edit a resource belonging to another user without authorization. The API-key edit/update path in `ApiKeyController` selects records by identifier without verifying that `user_id` matches the caller. The issue is fixed in version 7.3.0.

In sevenz-rust2 before 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In src/util/decompress.rs, decompress_impl computes each destination with dest.join(entry.name()) without normalizing the archive's UTF-16 entry name or verifying containment, and default_entry_extract_fn writes to it with File::create. Parent-directory components escape the extraction root, and an absolute entry path makes the join discard the destination entirely. The convenience entry points decompress, decompress_file, decompress_with_password, and decompress_file_with_password all use this default path. Overwriting writable configuration, startup, cron, or build files can lead to code execution or persistence.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No further vulnerability information is available.

In OpenRemote prior to 1.26.0, the datapoint export API constructs CSV crosstab SQL by concatenating asset and attribute names, allowing an authenticated user to inject SQL metacharacters. A crosstab export request can return injected SELECT output in the normal ZIP/CSV response, enabling database exfiltration. In multi-tenant deployments it may expose other tenants' data.

In Netopeer2, a low-privileged authenticated NETCONF user can remotely crash netopeer2-server by sending a get RPC with an invalid subtree filter containing format specifiers. In src/log.c the already formatted buffer is passed to np2log() as the format string, causing vsyslog() to interpret attacker-controlled percent sequences. Denial of service was confirmed on version 2.8.7; reliable remote code execution was not confirmed.

In the refitter dotnet tool prior to 2.1.1, NJsonSchema is invoked with unsafe $ref resolution defaults when generating Refit interfaces from attacker-controlled OpenAPI descriptions. Remote http(s) references cause requests from the developer or CI host and inline untrusted content, while absolute local paths and ../ traversal allow arbitrary local-file disclosure. The chain stops at SSRF, remote file inclusion, and local file inclusion, not code execution.

In LightSAML prior to 4.7.1 and 5.0.1, LightSAML and xmlseclibs disagree about which assertion an inbound SAML signature covers. XMLSecurityDSig::validateReference() removes the enveloped signature from the shared DOM, but processRefNode() resolves Reference URI="#id" document-wide via XPath //*[@Id] and takes item(0), which need not be the assertion whose claims LightSAML consumes. An attacker with a captured genuinely signed assertion can place its signature-stripped bytes in samlp:Extensions and present a forged assertion with the same ID and copied signature, enabling authentication bypass or privilege escalation.

In Kubewarden policies before version 2.1.2, the trusted-repos-policy compares an image's registry hostname against reject and allow lists case-sensitively even though registry DNS names are case-insensitive. An image with an uppercase or mixed-case registry hostname can miss a rejection rule for the equivalent lowercase host, so the admission policy accepts a resource whose container runtime pulls the same prohibited image.

In ActivityPub for Ghost from 1.0.0 until 1.2.6, the Undo handler allows a remote federated server to cause the service to act on a follow or repost as though the activity came from a different account. This permits removal of an existing follow relationship or repost belonging to another account without that account's involvement.

The standalone Element Call SPA (from 0.16.0 until 0.20.3) logs the `password` URL query parameter. When a user submits an error report (rageshake), these logs are shared with the application operator, potentially disclosing the shared password used to encrypt the call.

In LubeLogger prior to 1.6.8, `PrintRecordStickers` verifies access to the supplied `vehicleId` but fetches caller-supplied `recordIds` without checking that each record belongs to the authorized vehicle. An authenticated user can thus retrieve other users' records across multiple modules.

In unpatched uhttpd repository snapshots, `client_parse_header()` compares the `Transfer-Encoding` value to `chunked` case-sensitively, although transfer-coding tokens are case-insensitive. A mixed-case token is accepted without enabling chunked handling, allowing HTTP request smuggling on keep-alive connections.

In unpatched uhttpd repository snapshots, `uh_ubus_data_send()` can desynchronize HTTP request boundaries when a `POST /ubus` JSON body arrives in multiple TCP segments. The unread body suffix is then processed as a new request on the same keep-alive connection.

uhttpd is a small HTTP server. In unpatched repository snapshots, client_poll_post_data() in client.c consumes an invalid chunk-length line (e.g., a size exceeding INT_MAX), then clears r->content_length and r->transfer_chunked without draining the remaining body or setting request.connection_close. Attacker-controlled body bytes aligned as a complete HTTP request are then parsed and processed as another request on the same connection, causing HTTP request smuggling and request-boundary desynchronization.

In LORIS versions from 22.0.0 before 27.0.4 and from 28.0.0 before 28.0.2, the `imaging_browser` module API permits edits to imaging data without checking the frontend edit permissions. An authenticated API caller can modify imaging data without the required edit authorization.

In LORIS versions from 16.0.0 before 27.0.4 and from 28.0.0 before 28.0.2, the `issue_tracker` backend does not correctly verify edit access permissions, although the frontend restricts which issues a user may edit. An authenticated user can submit backend changes to issues outside their permitted edit scope.

fickling through 0.1.12 incorrectly treats calls to functions from Python standard library modules as safe without inspecting their actual behavior. As a result, check_safety() returns LIKELY_SAFE for malicious pickle payloads that reach code execution or file writes through such callables (e.g., dataclasses._create_fn, mailcap.findmatch, readline.write_history_file). Because fickling.load() uses this verdict as a security gate before pickle.loads(), the payload is deserialized and executed with the privileges of the victim process.

A vulnerability in Trail of Bits fickling through 0.1.12 allows a pickle STACK_GLOBAL operand with a dotted __qualname__ (e.g., "Values.read_file") to be resolved by pickle's find_class via _getattribute to an arbitrary attribute path instead of a module-level function. Fickling records only the leading component in its import tracking and renders the operation as a plain import, so the trailing attribute reference is never analyzed as a call; the OvertlyBadEvals pass does not flag it and check_safety() returns LIKELY_SAFE with zero findings. This lets an attacker reach a class method that performs code execution (optparse.Values.read_file executes exec(open(filename).read(), vars)), achieving arbitrary code execution when the crafted pickle is loaded through fickling.load(), which chains check_safety() into pickle.loads() as an explicit security gate.