CVE Vulnerability Catalog

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affects versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0.

The MCTP-over-I2C+GPIO target binding (mctp_i2c_gpio_target.c) fails to clear the selected register (b->reg_addr) and data-phase flag (b->rxtx) on I2C STOP. A bus controller can use two ordinary transactions to make mctp_bus_rx() run with a NULL buffer or to dereference b->tx_pkt->end after it was cleared, triggering an exception in the I2C target interrupt handler and a device reset or halt.

A race condition in the Zephyr kernel affects z_waitq_head(), which on SMP systems reads the head of a thread wait queue without holding the _sched_spinlock. The race between timer expiration handling and thread abort can cause out-of-bounds and use-after-free writes in supervisor context plus scheduler state corruption.

A vulnerability in the user-mode verifier for the peci_transfer() system call in Zephyr RTOS. The z_vrfy_peci_transfer() function only checked device object permission and copied the caller-supplied peci_msg structure without validating the buf pointers and len values inside the embedded tx_buffer and rx_buffer structures, which were passed unchecked to the driver. This allows a user with access to the PECI device to perform arbitrary kernel writes, kernel reads, and trigger a supervisor-mode fault.

A vulnerability was detected in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the component Admin Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit is now public and may be used.

MongoDB Compass improperly escapes certain BSON values when converting a stored view's aggregation pipeline into editable source. When a user connects to a deployment containing a specially crafted view and opens it for editing, the values can cause arbitrary code execution with the privileges of the user running Compass.

Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This affects versions 10.0.0 through 10.1.4 and 10.2.0.

In Vaadin Framework 8, VaadinService.requestEnd() locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request with a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and later requests to that session block forever, exhausting the thread pool and taking the application down. No authentication is required: a session cookie, which any client obtains with a single request, is enough.

Vaadin Charts renders charts with the Highcharts library and pins an exact version (9.2.2 in Vaadin 22-24 and 12.2.0 in Vaadin 25), so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsoft disclosed several vulnerabilities reachable through the chart configuration: writes to Object.prototype through dotted series.keys paths, and cross-site scripting through credits.href, breadcrumbs.style, HTML text parsing while printing, and xlink:href attributes in exported charts. An application is affected where attacker-controlled data reaches the chart configuration, for example through additionalOptions, updateConfiguration(), or text options that accept markup.

The Apache Pulsar Packages Management Service with the FileSystemPackagesStorageProvider did not validate the version component of a package name, which could contain URL-encoded path separators and parent directory references. This allowed the filesystem storage provider to resolve the version to a location belonging to a package in a different tenant or namespace, and the containment check inside the storage directory did not prevent the access. An authenticated user with the packages permission on any namespace could download, overwrite or delete packages in other tenants or namespaces.

Apache Pulsar contains two flaws in the authorization of requests forwarded by a proxy on behalf of another user. The first authorizes the original principal using the proxy's authentication data (affecting e.g. MultiRolesTokenAuthorizationProvider), and the second skips the original principal check for tenant admin operations when the proxy role is a tenant admin. This may allow users to perform operations beyond their own permissions.

A vulnerability in Apache Pulsar affects the shadow topics mechanism (PIP-180). The broker authorizes the caller only against the topic being created or updated, not against the source topic named in the PULSAR.SHADOW_SOURCE property. This allows an authenticated user with permission to create topics or update topic properties in one tenant to bind a topic to a source topic in another tenant and read its retained messages.

Apache Pulsar broker versions 2.8.0 through 4.0.13 and 4.1.0 through 4.2.4 do not apply the tenant admin check to the caller for the truncate operation on a partitioned topic. Instead, the broker truncates each partition using its own internal admin client, so an authenticated user without tenant admin rights but with lookup permission can truncate any partitioned topic. This skips unacknowledged subscription backlog and permanently deletes older ledgers regardless of the namespace retention policy.

When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smuggle requests past the front end and desynchronize responses for other users.

Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, allowing an attacker to smuggle requests past ATS access controls, disrupt other users' requests, or poison the cache.

NoMachine nxhtd contains a Server-Side Request Forgery information disclosure vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of NoMachine without authentication. The flaw exists within the web service listening on UDP port 4443 by default and results from the lack of proper validation of a URI prior to accessing resources.

The authentication mechanism controlling access to the Redis database in NoMachine uses insufficient entropy when generating credentials. A local attacker able to execute low-privileged code can exploit this to escalate privileges and execute arbitrary code in the context of the service account.

NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NoMachine without authentication. The flaw exists in the parsing of mDNS resource records due to lack of proper validation of user-supplied data length before copying to a heap-based buffer.

MindsDB contains a code injection remote code execution vulnerability in the OpenBBtable class. Authentication is required; the flaw is due to lack of validation of a user-supplied string before using it to execute Python code, allowing an attacker to execute code in the context of the service account.

CrewAI contains a remote code execution vulnerability via unsafe reflection during agent loading. User interaction is required—the target must load a malicious agent configuration from the repository. The flaw exists in the load_agent_from_repository function, which does not properly restrict a user-supplied argument before using it to import a module, allowing code execution in the context of the service account.