CVE Vulnerability Catalog

An authenticated user with limited read privileges may access documents from unauthorized collections due to an inconsistency in the $graphLookup aggregation stage evaluation between authorization and execution. Affected scenarios involve collections referenced within existing view pipeline definitions.

Vulnerability in MongoDB where an authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. This leads to an internal invariant failure and denial of service.

In MongoDB server, Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, $search and $searchMeta aggregation stages can be directly supplied by the client due to insufficient input validation.

Using expressions that generate large arrays, it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with an out-of-memory (OOM) error.

The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.

IBM Sterling B2B Integrator and IBM Sterling File Gateway versions 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 could allow an unauthenticated user to read sensitive information by bypassing authentication through a specially crafted HTTP request.

Elgg before version 7.0.0 does not check image dimensions, allowing a denial of service attack via a large avatar upload.

Caliptra Core Runtime Firmware version 2.1.0 has missing authorization in INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, and EXTERNAL_MAILBOX_CMD commands in subsystem mode. A privileged local attacker can cause denial of service via mailbox commands with unverified AXI addresses.

InvokeAI before version 6.13.7 has an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scan_folder endpoint. Attackers can recursively enumerate arbitrary directories and determine file existence and readability via HTTP response codes.

Graylog2 Server before commit 46a2eeb lacks per-entity permission checks in the POST /events/definitions/{definitionId}/duplicate endpoint. Authenticated users with low privileges can clone any event definition, reading private detection queries, aggregation thresholds, schedules, and notification bindings.

In librest, the PKCE implementation uses the cryptographically insecure GRand function from GLib, allowing an attacker to reverse-engineer the PRNG seed and bypass PKCE protections.

Froiden TableTrack up to version 1.3.10 has a stored XSS vulnerability. Unauthenticated attackers can inject arbitrary HTML and JavaScript via the order notes field without sanitization. Payloads execute in the admin's browser session when viewing order details, enabling session token theft or unauthorized administrative actions.

Dell PowerProtect Data Manager versions prior to 20.2.0.0 contain an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability to achieve remote code execution.

Dell PowerProtect Data Manager versions prior to 20.2.0.0 contain an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the REST API. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.

A flaw in BIND 9: accepting an invalid data structure in a DNS record (PRIVATEDNS algorithm with incorrect length) can cause the server to abort when rendering the record to text.

BIND may accept incorrect child-zone NSEC3 records as valid, allowing an attacker to forge authenticated NXDOMAIN responses. This affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and corresponding -S1 versions.

In Unbound 1.20.0 through 1.25.1, with 'serve-expired: yes' and 'serve-expired-client-timeout > discard-timeout > 0', the discard-timeout logic fails to properly decrement a counter, leading to new clients being dropped and service degradation. An attacker can exploit this by querying a slow authoritative zone.

In NLnet Labs Unbound up to version 1.25.1, when building the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, the validator computes the address of the second embedded domain name as 'datstart + dname_valid(datstart, ...)' and passes it directly to 'query_dname_tolower()' without checking that a second name is actually present in the RDATA. An attacker running a DNSSEC-signed authoritative server can deliver a record with an absent second domain name (e.g. SOA record) and cause 'query_dname_tolower()' to walk through stale bytes in the 'env->scratch_buffer', past the end of its heap allocation if 'msg-buffer-size' has been lowered. This leads to a heap buffer overflow.

In Unbound 1.22.0 through 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions) and crash the Unbound process using a single DoQ connection and one DNS query. This is due to passing an erroneous error value to libngtcp2.

In Unbound 1.7.0 through 1.25.1, when there are more DNSCrypt certificates than keys, Unbound fills leftover slots with '0xdb' bytes. An unauthenticated client sending a UDP datagram ≥68 bytes with first 8 bytes '0xdb' to the DNSCrypt port can crash the server.