CVE Vulnerability Catalog

A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the disclosure of sensitive operational information, such as goroutine, heap, and command-line details, after completing a basic encrypted connection. This vulnerability does not enable direct remote code execution.

xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted.

SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers can supply arbitrary dashboard IDs to rename dashboards and overwrite component data, canvas styles, and view information belonging to other workspace members.

Concrete CMS Community Store before version 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts or exfiltrate data.

uutils coreutils before version 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems.

hickory-resolver before version 0.26.2 fails to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.

A denial of service flaw was found in Poppler's Splash backend. A crafted PDF with tiling-pattern geometry approaching the int32 boundary can cause SplashOutputDev::tilingPatternFill to compute an attacker-controlled repeat count that drives an excessively long loop in the pattern-fill scanline routine, without a corresponding memory allocation. An attacker could exploit this by supplying a malicious PDF to an application that renders it via Poppler's Splash backend, causing the rendering process to consume 100% CPU for an attacker-controlled, extended duration.

Integer overflow in µD3TN v0.15.0 TCPCLv3 handshake causes heap overflow, allowing remote attackers to reliably cause DoS.

A flaw in Netty netty-codec-smtp is the improper validation of Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP commands, leading to SMTP command smuggling.

A flaw in Netty's HTTP/1.1 decoder allows a remote attacker to bypass Transfer-Encoding header validation by splitting the field across multiple headers, with the last containing a non-final transfer coding like gzip or deflate. This bypass can lead to HTTP request smuggling.

A flaw in Netty's HTTP/1 to HTTP/2 conversion process occurs when an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header. Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority.

A flaw in Netty causes specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests to be incorrectly processed as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information.

A flaw in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can supply a different Host header, producing a malformed HTTP/2 CONNECT request.

A flaw in Netty allows a remote attacker to send a specially crafted HTTP request with control characters in the chunk-size line. This bypasses strict validation, allowing injection of arbitrary HTTP requests and request smuggling.

A flaw in Netty's RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in RTSP requests. A remote attacker can send a specially crafted RTSP request, leading to method-token smuggling.

A flaw in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This leads to memory exhaustion.

A flaw in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can use HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to unbounded growth of a per-connection queue and excessive memory consumption.

A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. This patch is called 05b4f9efeb79e9d72a693232334d7529687f896f. It is best practice to apply a patch to resolve this issue.

SveltyCMS 0.0.6 contains a cross-site scripting (XSS) vulnerability in the SVG Media Upload component, in the file src/utils/media/media-service.server.ts. Input manipulation can lead to malicious script execution, and the attack can be initiated remotely.

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding.