CVE Vulnerability Catalog

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. It contains no technical vulnerability description or affected component information.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. It contains no technical vulnerability description or affected component information.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. It contains no technical vulnerability description or affected component information.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. It contains no technical vulnerability description or affected component information.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. It contains no technical vulnerability description or affected component information.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. It does not contain a valid vulnerability description.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. It does not contain a valid vulnerability description.

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that survive password changes, retaining full control of the dashboard since tokens are verified only against a static JWT secret that is never rotated.

Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit unlimited password guesses without rate limiting, attempt counters, lockouts, or delays to gain full administrator access and modify application configuration.

gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwrite_existing enabled, attackers can craft malicious repository trees where symlink entries replace validated directories, causing subsequent files to be written outside the worktree through the symlink for code execution or file manipulation.

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single unauthenticated request to consume provider quota or access sensitive configuration data.

The WikiLambda extension in MediaWiki contains an XSS (Cross-Site Scripting) vulnerability due to improper input neutralization during web page generation. The issue affects version 1.47.0-alpha and has been remediated on the master branch.

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from * before 3.7.

The UploadWizard extension in MediaWiki contains an XSS (Cross-Site Scripting) vulnerability due to improper input neutralization during web page generation. The issue affects versions from * before 1.46.1, 1.45.5, 1.43.10.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. It does not contain a valid vulnerability description.

The FlaggedRevs extension for MediaWiki through version 1.46.0 fails to properly remove sensitive information before storage or transfer. This can lead to exposure of data that should have been redacted or removed.

PHP's OpenSSL stream peer verification checks subjectAltName entries first and falls back to Common Name when no entry matches. RFC 6125 requires CN to be ignored once the certificate presents any service identity, so a certificate with a non-matching DNS SAN was still accepted when its CN matched the requested peer_name.

php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation.

When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin.

cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.