CVE Vulnerability Catalog

Format Plugins is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction (opening a malicious file).

TinyWeb through version 0.0.8 has a path traversal vulnerability allowing unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path. The path is concatenated without normalization, dot-segment removal, or boundary checks. Attackers can expose sensitive files like credential stores and private keys when the server runs as root.

TinyWeb through version 0.0.8 has a null pointer dereference vulnerability allowing unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. HttpParser::execute() fails to allocate the Url object, and buildResponse() dereferences the NULL pointer without checking the valid_requ flag, causing SIGSEGV and permanent server shutdown after repeating on all workers.

TinyWeb through version 0.0.8 has a memory leak vulnerability allowing unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request allocates Url, HttpHeaders, and HttpHeader objects via raw new expressions that are never freed due to missing destructors and unreachable delete calls, causing worker memory to grow by ~20-28 kB per request until the process is killed.

Rouille versions 0.3.3 through 3.6.2 have an HTTP request smuggling vulnerability allowing remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into client-supplied header values. These values are copied verbatim to upstream connections without validation. Attackers can craft a header containing an additional HTTP request interpreted as separate by backends (e.g., Go net/http, Python http.server), bypassing Rouille's access control logic.

QTI Neon version 1.0.0 has a vulnerability in the relay's handleReconnectRequest function that forwards RECONNECT_REQUEST packets to the host without bounding them. An unauthenticated client can cause relay-to-host amplification, leading to denial of service (DoS) on the host. No fixed version is available.

A vulnerability in the OAuth Ruby library allows an attacker to capture the Authorization header during a redirect. The OAuth::Consumer client follows a 3xx redirect, which can mutate the configuration and expose sensitive data.

A vulnerability in the OAuth2 Ruby library allows the Authorization header to leak to an attacker-controlled host. A protocol-relative redirect overrides the request authority.

The gopacket library for Go version 1.6.0 and earlier has a vulnerability in the Diameter AVP decoder. An attacker can control the Length field in an AVP, causing an unsigned 32-bit underflow and allocation of about 4 GiB memory. Two such messages can cause OOM and denial of service.

The gopacket library for Go version 1.6.0 and earlier has a vulnerability in the sFlow ExtendedGatewayFlow decoder. An attacker controls 32-bit community and AS path member counts, leading to allocation of up to 16 GiB memory from a 104-byte UDP datagram, causing denial of service.

A vulnerability in sg3_utils (sg_inq command) allows injection of properties into the udev database. Control characters in SCSI names are not sanitized, enabling arbitrary command execution as root when the device is disconnected.

A vulnerability in Camaleon CMS allows an authenticated user with custom field management permissions to execute arbitrary Ruby code. A malicious expression in the select_eval field is evaluated via instance_eval when rendering the post edit page.

A vulnerability in Pterodactyl causes a global login rate limit affecting all users. The limit is global, not per IP, allowing an attacker to block login for everyone by sending about 10 requests per minute.

A vulnerability in Pterodactyl allows an authenticated subuser to write arbitrary files to the server without the required permissions. A JWT token issued for other operations (e.g., WebSocket) can be reused for file uploads.

A vulnerability in the wakaru JavaScript decompiler allows writing files outside the target directory. Filenames with traversal sequences (e.g., ....//) are sanitized only once, allowing escape from the output directory.

A vulnerability in NVIDIA DCGM Exporter allows an attacker to cause excessive resource consumption by sending unauthenticated profiling requests to the /debug/pprof endpoint. This can lead to denial of service and information disclosure.

A vulnerability in GitHub MCP Server causes a Go panic (nil pointer dereference) when handling a completion/complete request with a missing or empty ref field. Since the crash occurs before authentication, any unauthenticated client can cause a denial of service.

WordPress Coding Standards (WordPressCS) from version 0.14.1 to 3.4.0 contains a vulnerability in the WordPress.WP.EnqueuedResourceParameters sniff. The is_falsy() method executes eval() on the $ver argument, allowing arbitrary code execution during PHPCS scanning. An attacker can supply a malicious argument like 'system'('id'), leading to command execution on the scanning host.

Appium Java Client from version 8.2.1 to 10.1.0 has a vulnerability in the directConnect mechanism. When directConnect(true) is enabled, the client reads directConnectHost, directConnectPort, and directConnectPath from the NEW_SESSION response and rebuilds the server URL, validating only the https protocol. A malicious server can redirect traffic to any destination, enabling session interception and SSRF attacks on internal hosts.

ArkSigner Desktop Client from version v2.2.16.10 through 17062026 has an Uncontrolled Search Path Element vulnerability allowing Search Order Hijacking. An attacker can place a malicious library in the search path, leading to unauthorized code execution.