CVE Vulnerability Catalog

Netty prior to versions 4.1.136.Final and 4.2.16.Final does not validate AF_UNIX addresses for CRLF characters in the HAProxyMessageEncoder, allowing an attacker to inject \r\n sequences and split the PROXY header into multiple lines. This enables spoofing of client source/destination IP to a downstream server or load balancer.

Netty prior to versions 4.1.136.Final and 4.2.16.Final fails to deduplicate or validate Host headers during HTTP/2-to-HTTP/1.x translation. When an HTTP/2 client supplies both the :authority pseudo-header and a literal host header, the translator creates an HttpRequest with two different Host headers, enabling request smuggling or cache poisoning attacks.

MathLive prior to version 0.110.0 fails to escape text-mode content in \text{} and \mbox{} commands, allowing arbitrary JavaScript execution when rendered. The vulnerability affects Box.toMarkup, xmlEscape, scanText, and MathML output formats.

The zipx.Unzip function in Develar's app-builder is vulnerable to arbitrary file overwrite on macOS APFS by exploiting a Unicode normalization collision combined with symlink following. APFS treats certain Unicode-equivalent filenames as identical, and app-builder does not normalize paths before validation.

Courier IMAP before 6.0.1 and Courier Mail Server before 2.0.2 allow authenticated IMAP users to crash the imapd process via deeply nested parenthesized SEARCH queries. The SEARCH command parser recursively descends without depth limit, and no command line length limit makes exploitation trivial; about 2500 nested parentheses cause stack overflow and SIGSEGV.

Improper validity period check for the root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to be considered trusted even if it is invalid.

The setCookie function in undici before versions 6.28.0, 7.29.0, and 8.9.0 does not fully sanitize cookie attributes. Domain values are not checked for semicolons, and unparsed array entries are not sanitized, allowing attacker-influenced input to inject additional attributes like SameSite, HttpOnly, or Secure without the caller's knowledge.

Xlight FTP Server before version 3.9.5 discloses the GetTickCount() value to unauthenticated attackers by sending a USER command with a username ending in :adm. Attackers can trigger the admin protocol path within the standard FTP listener pre-authentication, leaking timing information from the FTP 331 response.

An XML External Entity (XXE) vulnerability in the veraPDF-validation library allows an attacker to read local files and send outbound network requests via a crafted PDF containing malicious rich-text annotations, form field values, or XFA configurations.

A denial-of-service vulnerability in the veraPDF-parser PDF parser allows an attacker to exhaust memory, CPU, or stack via a crafted Type 1 font program that triggers unbounded PostScript array allocation, a zero-increment loop, or recursive user dictionary lookups.

A denial-of-service vulnerability in the veraPDF-parser PDF parser allows an attacker to exhaust memory or CPU via a crafted Type 0 font CMap stream that triggers unbounded PostScript array allocation or a zero-increment loop.

A vulnerability in Penelope Shell Handler (prior to 0.20.0) allows writing files outside the intended download directory via a crafted tar archive, potentially overwriting the ~/.penelope/peneloperc configuration file.

An Out-of-Bounds Read vulnerability in Autodesk AutoCAD when parsing a maliciously crafted DWG or DXF file can cause a crash or disclose sensitive information.

An Out-of-Bounds Read vulnerability in Autodesk AutoCAD when parsing a maliciously crafted DWG or DXF file can cause a crash or disclose sensitive information.

A missing authorization vulnerability in MWDB Core (versions >=2.0.0 and <2.19.0) in the deprecated config and blob upload endpoints allows an authenticated user without the required capabilities to upload config and text blob objects via the POST method.

A vulnerability in swagger-typescript-api (prior to 13.12.2) allows an attacker to use an OpenAPI spec to make requests to internal or link-local services, as the generator does not properly validate external $ref URLs.

A vulnerability in the cJSON library (up to version 1.7.19) causes JSON Patch operations (RFC 6902) to be non-atomic – on validation failure, the target element is removed before full validation, allowing an attacker to modify the document despite an error being reported.

A vulnerability in the cJSON library (up to version 1.7.19) causes inefficient algorithmic complexity in cJSON_Compare(), which performs an exponential number of operations when comparing deeply nested objects, potentially leading to denial of service (DoS).

The nanoid (Nano ID) library before versions 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module. When given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, hanging the calling thread.