CVE Vulnerability Catalog

In openhole 0.1.1 and earlier, the server forwarded r.URL.Path instead of the original request target, allowing percent-encoded dot segments and separators to perform path traversal in tunneled local services.

In gotd/td before version 0.145.1, the Decode function read attacker-controlled dataLen from an unauthenticated MTProto packet and allocated memory before checking the remaining buffer, allowing remote denial of service via excessive memory allocation and CPU or garbage collection pressure.

In find-my-way before version 9.7.0, the lookup() function passes req.method to find(), which indexes this.trees[method]. Since this.trees is a normal object, HTTP/2 method values like constructor can resolve inherited properties, causing a crash when accessing currentNode.prefix.length.

In datamodel-code-generator from 0.11.6 to 0.64.0, attacker-controlled x-python-import or customTypePath schema extensions can reach the JSON Schema parser and generate imports that allow newline injection into import statements, executing Python code when the generated model is imported.

In datamodel-code-generator before version 0.63.0, URL host validation checks the host once but then allows httpx to resolve the host again for the connection, enabling DNS rebinding to bypass allow_private_network=False and reach internal services.

In datamodel-code-generator from 0.59.0 to 0.62.0, XML Schema parsing resolves schemaLocation values in xs:include, xs:import, xs:redefine, and xs:override outside the input base path, allowing arbitrary local files to be read and reflected into generated models.

The datamodel-code-generator tool before version 0.62.0 improperly handles JSON Schema $ref references, allowing arbitrary local file reads. The vulnerability is in jsonschema.py, which does not block file:// or ../ paths outside the input directory.

The datamodel-code-generator tool from version 0.9.1 to 0.61.0 does not validate hosts/IPs in URL targets and redirects, enabling SSRF attacks against internal resources. The vulnerability is in the http.get_body function.

The datamodel-code-generator tool from version 0.9.1 to 0.61.0 automatically dereferences JSON Schema $ref references from HTTP/HTTPS without proper blocking, enabling SSRF attacks. The --allow-remote-refs flag only warns instead of blocking.

The datamodel-code-generator tool from version 0.52.1 to 0.60.2 interpolates validators from --extra-template-data without safe validation, allowing Python code execution when the generated Pydantic v2 model is imported.

The datamodel-code-generator tool from version 0.51.0 to 0.60.2 inserts x-python-type values into field annotations without sufficient validation, allowing Python code execution when the generated module is imported.

The datamodel-code-generator tool from version 0.14.1 to 0.60.2 renders the comment field from --extra-template-data into Python comments without neutralizing carriage returns, allowing Python code injection into generated models.

The datamodel-code-generator tool from version 0.17.0 to 0.60.2 preserves attacker-controlled default_factory values and emits them into Field(default_factory=...), allowing Python expression execution when the model is imported.

The datamodel-code-generator tool before version 0.60.1 renders GraphQL Union description values into Python comments without neutralizing carriage returns, allowing Python code injection into generated models.

In Dompdf versions 3.15 and prior, there is a Denial of Service (DoS) vulnerability via resource exhaustion. An attacker can submit a specially crafted HTML document with a single image of massive dimensions (e.g., 30,000x30,000 pixels), causing large memory and CPU allocation. This issue is fixed in version 3.16.

In Dompdf versions 3.15 and prior, a BMP image is accepted and a PDF-compatible PNG is generated based only on its declared header dimensions, without bounding width × height before conversion via GD. A small BMP (58 bytes) with a header declaring e.g. 6000×6000 causes full pixel canvas allocation, leading to significant memory amplification (up to 12x). This issue is fixed in version 3.16.

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling.

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling due to improper handling of TRACE requests.

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 ND Collective Controller is vulnerable to a path-segment injection vulnerability in the collective routing mechanism.

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens.