CVE Vulnerability Catalog

In OpenVPN (versions 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4), a use-after-free allows remote authenticated peers to potentially cause denial of service or memory leakage via crafted packets during TLS session promotion or expiry.

IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipulate other users' build jobs through improper access control on log retrieval and unauthenticated build endpoints.

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets.

A vulnerability in IBM PowerVM Hypervisor allows a carefully crafted OS hypervisor call to cause the hypervisor to crash or compromise OS memory integrity.

A vulnerability in OpenVPN versions 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers to exploit an off-by-one buffer write in NTLM proxy authentication, potentially causing a crash via a crafted NTLM response from a malicious proxy server.

A vulnerability in Samba Active Directory Domain Controller (AD DC) combines LDAP filter injection with improper authorization checks, allowing an authenticated low-privilege domain user to disclose confidential AD attributes such as msKds-RootKeyData, potentially leading to privilege escalation and full domain compromise.

An SSRF vulnerability in Kanboard 1.2.52 and prior allows authenticated users to bypass SSRF protections by supplying hexadecimal IP address notation in user-controlled URLs, enabling access to internal network resources such as cloud instance metadata services or localhost services.

Apache JSPWiki up to version 2.12.3 is vulnerable to arbitrary Wiki markup rendering due to lack of authentication. An attacker can obtain sensitive data stored in JSPWiki variables.

Apache JSPWiki up to version 2.12.3 is vulnerable to JSON Hijacking, which leads to CSRF vulnerabilities. An attacker can exploit this to perform unauthorized actions on behalf of a user.

Apache JSPWiki up to version 2.12.3 reveals unnecessary information in debug messages. This can lead to leakage of sensitive data.

A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege user to access an endpoint that returns records of other users without checking ownership.

A vulnerability in IBM WebSphere Application Server 8.5 and 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.7 could allow a remote attacker to bypass security constraints.

A vulnerability in Calico's Application Layer Policy (disabled by default) fails to perform URL path normalization, allowing attackers to bypass Prefix path rules using path-traversal segments, encoded slashes, or repeated slashes, enabling access to restricted HTTP endpoints.

A vulnerability in OpenCost before version 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing unauthenticated attackers to modify GCP service account keys via POST /serviceKey.

A vulnerability in Julep involves an insecure direct object reference (IDOR) in the get_execution_details endpoint, allowing authenticated tenants to read another tenant's execution data by supplying arbitrary execution_id values.

An SSRF vulnerability in Swarms through version 6.8.1 (fixed in commit 8b0fc9e) lies in the _is_safe_url function that fails to validate hostnames through DNS resolution, allowing attackers to bypass the blocklist by supplying image or audio URLs that resolve to private, loopback, or metadata addresses.

A vulnerability in MaxKey through version 4.1.12 (fixed in commit ddbb72f) involves insufficient redirect URI validation in DefaultRedirectResolver.hostMatches(), allowing remote attackers to hijack OAuth 2.0 authorization codes by supplying a crafted redirect_uri whose hostname suffix matches a registered URI without proper dot-boundary anchoring.

The Boruta library in Elixir has an improper isolation vulnerability allowing unauthenticated attackers to register OpenID Connect clients with administrative privileges. The lack of an allowlist lets attackers set sensitive attributes like grant types, scopes, PKCE enforcement, and token lifetimes.

A vulnerability in Calico's optional debug server (pprof), when enabled, listens on 0.0.0.0 without authentication. Any pod with network access can read the process heap, goroutine stacks (including function arguments), and command-line arguments, potentially exposing sensitive data.

IBM Enterprise Build of Quarkus REST has a vulnerability due to unbounded accumulation of multipart MIME part-header bytes, potentially leading to resource exhaustion.