CVE Vulnerability Catalog

The ip-address library for JavaScript versions 10.1.1 through 10.2.2 contains a vulnerability where special-use classification methods (isLoopback, isPrivate, isLinkLocal, isCGNAT, isMulticast, isUnspecified, isBroadcast, isULA, getType) rely on isInSubnet, which returns false when the address's subnet mask is shorter than the reference range's mask. Appending a CIDR suffix like /0 causes all these methods to report an internal address as unremarkable, while correctForm() and address still return the real internal target. Applications using these checks for network trust-boundary decisions, such as SSRF filters, may treat an internal target as external and allow the request. Fixed in version 10.2.2.

Reflected XSS vulnerability in the oaskit library for Elixir. The flaw is due to missing HTML escaping in the default error handler, which renders request validation failures as HTML pages. An attacker can craft a malicious link that executes arbitrary JavaScript in the victim's browser within the application's origin.

Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to invoke predefined component validation methods with alternative settings. Apache NiFi installations that do not implement different levels of authorization for viewing and modifying Parameter Context configuration are not subject to this vulnerability.

The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract plaintext AWS credentials by calling the load_aws_credentials function with the redact_secret parameter set to false, circumventing the allow_unredacted_secrets=false policy. Attackers can retrieve access_key_id, secret_access_key, session_token, and region in plaintext, which are immediately valid against AWS APIs, especially impactful in managed environments where pg_duckdb is preloaded and an AWS credential chain is reachable.

Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server before 2.0.24 allows a remote unauthenticated attacker (via prompt injection) to obtain Amazon MQ for RabbitMQ broker credentials or OAuth access tokens sent to a crafted endpoint controlled through a broker hostname introduced in the MCP client context.

Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSH sessions and file transfers via network positioning between the client and the EMR cluster endpoint.

A vulnerability in danpros HTMLy up to 3.1.1, affecting the unlink function in /system/htmly.php of the Delete Username Endpoint component, allows manipulation of the File argument leading to path traversal. The attack can be launched remotely, and the exploit is publicly available.

A security flaw in langgenius dify up to 1.14.2, affecting the jinja2.Template function in api/core/helper/code_executor/jinja2/jinja2_transformer.py of the Jinja2 Handler component, results in improper neutralization of special elements used in a template engine. The attack can be launched remotely, and the exploit is publicly available.

A vulnerability in jeequan jeepay up to 3.2.9, affecting the WebSecurityConfig function in jeepay-manager/src/main/java/com/jeequan/jeepay/mgr/ctrl/sysuser/SysLogController.java of the PreAuthorize Handler component, leads to authorization bypass. The attack can be initiated remotely, and the exploit is publicly available.

A stored XSS vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread entry title field. User-controlled input in the title is stored without adequate HTML escaping and later rendered in staff-facing templates without proper output encoding. An attacker can inject arbitrary JavaScript by submitting a crafted ticket reply or email with a malicious subject line.

osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name. The value is extracted without sanitization in include/class.mailparse.php and stored raw in the poster field of ost_thread_entry. An unauthenticated attacker can send a reply email to an existing ticket from an unregistered address with an XSS payload in the From display name.

A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection. An attacker who obtains access to stored credential data may be able to recover valid credentials to gain unauthorized access to affected devices or management environments.

A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimate device completes registration, resulting in provisioning information being delivered to an attacker. Successful exploitation may allow disclosure of provisioning information intended for a legitimate device.

The Omada device adoption process transmits authentication credentials using a weak hashing algorithm. An attacker intercepting the traffic may recover valid credentials and gain unauthorized access to managed devices.

Dell Monitor driver version 1.0.0.0 has an improper link resolution vulnerability. A low-privileged local attacker could exploit it to elevate privileges.

In communication between Omada devices and cloud controllers, there is a certificate validation weakness. Certificate identity verification does not adequately check that the certificate matches the expected cloud controller hostname, potentially allowing certificate validation protections to be bypassed.

PostCSS prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application.

Angular prior to versions 20.3.27, 21.2.19, and 22.0.1 contains a vulnerability in the Angular compiler i18n pipeline that permits i18n-onerror and other i18n-on event-handler attributes. This allows a lower-trust translation file to replace a static handler with executable JavaScript.

Angular prior to versions 20.3.27, 21.2.19, and 22.0.7 contains a Cross-Site Scripting (XSS) vulnerability in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>).

Angular prior to versions 20.3.27, 21.2.19, and 22.0.2 contains a vulnerability in HttpTransferCache that comma-joins repeated request parameters. This allows semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response.