CVE Vulnerability Catalog

Enforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a malformed stream feedback frame. Stream::SetRemoteConsumed() contains CHECK(_cur_buf_size > 0) and unconditionally asserts CHECK(buf.IsEmpty()) on the frame payload; a feedback frame with an unexpected payload or received on a stream with flow control disabled reaches these assertions, and CHECK failures abort the process.

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

An improper array index validation vulnerability in Velneo vServer affects versions from 36.0 before 36.6 and from 37.0 before 37.2. The flaw may lead to unsafe out-of-bounds memory access.

PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize(), enabling gadget-chain code execution, file writes, or denial of service.

Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded accounts using the password 'password'.

Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or leak full ticket documents including internal notes.

ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables.

Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users with only `access_dashboard` to create administrators and grant permissions. Attackers can call `CreateTeamMember::store()` or `Permissions::togglePermission()` directly over `/livewire/update` to create admin accounts and escalate to full administrator.

A SQL injection vulnerability was found in the Insurance-Management-System within the mysqli_query function of /Agent/ManagePolicy/EditPolicyHolder.php. Manipulating the Policy_no/Name argument allows SQL injection. The flaw can be exploited remotely and a public exploit is available.

A vulnerability in the streaming RPC component of Apache bRPC (versions < 1.18.0) allows a remote attacker to exhaust server memory and cause denial of service by sending a single RPC request that declares an excessive number of streams. The server creates one response stream per stream identifier in the extra_stream_ids field without limiting the number of streams accepted in a single RPC, and each stream allocates its own bthread execution queue and resources.

A vulnerability in Apache bRPC (versions < 1.18.0) allows unbounded memory accumulation in the stream message reassembly path. A remote attacker can send an endless sequence of continuation data frames to exhaust server memory, causing a denial of service.

An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through 1.17.0). A client creating multiple streams in a single RPC indexes returned extra_stream_id values without first validating the returned list size, so a malicious or compromised server can return a malformed StreamSettings response with fewer identifiers and trigger an out-of-bounds read.

Resource exhaustion vulnerability in Apache bRPC versions before 1.18.0 affects multiple parsers that accept wire-controlled input. The gzip/zlib/snappy decompressors enforce no output limit, and the AMF, RTMP, sofa-pbrpc, and mcpack2pb parsers trust wire-declared sizes, allowing attackers to cause disproportionate memory use and crash the process.

Apache bRPC versions < 1.18.0 contain an uncontrolled resource consumption vulnerability in the HTTP/2 (h2) receive path. A remote unauthenticated attacker can send crafted HTTP/2 frames to crash the server or cause unbounded memory growth. The root cause is that receive-side limits (e.g., MAX_CONCURRENT_STREAMS, MAX_HEADER_LIST_SIZE) are advertised but never enforced, and control-frame acks bypass the write buffer cap.

A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC (version < 1.18.0) allows a remote attacker to crash the server process by sending a crafted sequence of HPACK headers, resulting in a denial of service. The root cause is an incorrect dynamic-table ring buffer sizing (34 instead of 33 bytes per entry), which leads to overflow and a CHECK abort.

A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. When the Abort message names the chunk stream currently being parsed, the object is deleted while Feed() is still running, leading to use-after-free.

Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) allows remote attackers to make the server allocate a large amount of memory by sending a crafted mcpack request with a huge array item count. The parser trusts the item count from the header without validating it against the actual payload size, potentially preallocating about 16GB of virtual memory.

An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value_size. The UnparsedValue::as_string() function computes `_size - 1` without validating `_size`; when value_size is 0 the expression underflows to SIZE_MAX, resize() throws std::length_error, and because the exception is not caught on the request parsing path the process aborts (SIGABRT).

An out-of-bounds read vulnerability exists in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned (e.g., ARM64). Input bytes with the high bit set (0x80–0xFF) are not normalized to the signed-char range, causing lookup-table indices in URL parsing and case-insensitive header lookup to exceed table bounds. This allows remote attackers to crash the process and cause denial of service via crafted input.

Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing. A remote unauthenticated peer can cause an affected process to buffer message data beyond the configured limit, which may lead to memory exhaustion and denial of service.