CVE Vulnerability Catalog

Consul Community Edition and Consul Enterprise versions 1.19.1 through 2.0.2 did not enforce the `session:write` ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions without holding the required permission.

Consul Community Edition and Consul Enterprise versions 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow the agent's Connect CA roots cache without bound, defeating the operator's cache-disable configuration.

A vulnerability in Consul Community Edition and Consul Enterprise versions 1.17.0 through 2.0.2 causes uncontrolled resource consumption in the Connect authorization endpoint. This allows an attacker to grow the agent's intention-match cache without bound, defeating the operator's cache-disable configuration. The issue is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

A vulnerability in Consul Community Edition and Consul Enterprise versions 1.18.0 through 2.0.2 allows an authenticated attacker to crash the Consul server during the Enterprise-to-Community downgrade path. A caller with config-entry write permission can submit a service-router configuration entry that causes the agent to exit unexpectedly. The issue is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

A vulnerability in Consul Community Edition and Consul Enterprise versions 1.20.1 through 2.0.2 allows an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. The issue is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

A vulnerability in the Hono framework from version 3.8.0 to 4.12.33 affects memo() from hono/jsx, which retains the result of a server-side render and reuses it for later renders with equal props. Request-scoped values read inside the component are not part of the comparison, potentially causing a user to receive HTML rendered for another user's request. The issue is fixed in version 4.12.34.

A vulnerability in the Hono framework from version 4.12.0 to 4.12.33 affects the languageDetector middleware, which is vulnerable to algorithmic complexity denial of service when processing a crafted language tag with a large number of hyphen-separated subtags. The normalizeLanguage() function repeatedly calls parts.slice(0, i).join('-') for every possible prefix, causing quadratic processing growth. The issue is fixed in version 4.12.34.

A vulnerability in TestLink 1.9.20 and earlier is an insecure direct object reference (IDOR) that allows any authenticated user, including guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without project or role authorization checks. Attackers can enumerate sequential IDs to retrieve files from private projects.

A vulnerability in the Kirby content management system prior to version 4.9.5 and from 5.0.0 through 5.5.1 causes the REST API error handler to return unsanitized PHP error messages, exposing the full filesystem path of the Kirby installation to unauthenticated API users. This affects all sites that have not disabled the REST API with the 'api' => false option. The issue is fixed in versions 4.9.5 and 5.5.2.

A vulnerability in the Aviation Very High Frequency Link Control X.25 layers involves malformed or out-of-sequence frames causing repeated resets, which may increase workload and reduce situational awareness. This attack can be carried out remotely over radio frequency.

A vulnerability involves broadcast control frames that can disconnect multiple aircraft simultaneously, leading to delayed clearances and air traffic controller overload. This attack can be carried out remotely over radio frequency.

The vulnerability affects the Aviation VHF Data Link protocol and allows remote termination of CPDLC sessions via malformed frames, forcing a fallback to voice communication and increasing controller workload.

In the Frappe framework before versions 16.20.0 and 15.112.0, an authenticated user can gain unrestricted access to the Document Follow API (update_follow).

In Netty before versions 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator codec does not clear partial aggregate state after exceeding the maxElements limit, allowing an unauthenticated peer to keep aggregate state alive after an exception and pin retained pooled buffers.

In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out. Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own systems.

In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. This requires a malicious application co-installed on a device with the Datadog app installed, and an OAuth token the attacker is willing to load into the victim's app. Impact: A co-installed application can switch the victim's Datadog app to a session the attacker controls. This is an account-confusion issue; it does not by itself expose the victim's existing session or data.

In Datadog Android app versions prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase (notification title, message, recipient, service, tags, and on-call/incident deep links) and SearchRecentDatabase (the user's full in-app search history).

In Datadog Android app versions prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversation_id. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ID 9201 (the Bits AI chat notification), with no check on the caller's identity or ownership of the conversation.

In the Datadog Android app before v545-5.9.2, six widget configuration activities are exported without permission guards. A malicious app can exploit sequential widget IDs to hijack a user's session and display infrastructure data on screen.

In Datadog Android app versions prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID, and an arbitrary Intent to run inside the Datadog process.