CVE Vulnerability Catalog

In the conda-smithy tool, prior to version 3.61.0, a vulnerability allowed unintended access to feedstock repositories through GitHub username takeover. The issue stemmed from using mutable GitHub usernames as identifiers for repository invitation routing.

In Coturn prior to version 4.10.0, a stack buffer overflow exists in decode_oauth_token_gcm(). An attacker can supply an OAuth token with a nonce_len field up to 65535, which is directly used in memcpy() to copy data into a 256-byte stack buffer, causing up to 735 bytes to be written past the buffer. The overflow occurs before AES-GCM authentication is verified, so the attacker does not need the OAuth key or a valid token.

In versions 0.1.5.post3 and prior, the WhatsApp bridge in nanobot does not sanitize the fileName field from an incoming document message, allowing an attacker to escape the media/ directory by sending a crafted filename.

Punto Switcher through version 4.5.0.583 contains an unquoted search path element vulnerability that allows local attackers to execute arbitrary code. They exploit the application's call to WinExec without a fully qualified path for RunDll32.exe when invoking shell32.dll Control_RunDLL input.dll.

A flaw in Node.js HTTP/2 server API allows servers to keep accepting data even after sending a `GOAWAY` frame. This affects **Node.js 22** and **Node.js 24**.

In AzeoTech DAQFactory versions 21.1 and prior, a Type Confusion vulnerability can be exploited by an attacker using specially crafted .ctl files which can result in code execution.

The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL client certificate by sending a forged HTTP header. An attacker can spoof certificate DNs and authenticate as any user. Fixed in 2.202.

AutoGPT, a workflow automation platform, has an XSS vulnerability in versions prior to 0.6.62 on the signup page. The application improperly trusts a URL parameter (`next`), allowing an attacker to execute malicious JavaScript in the victim's browser.

HAProxy up to version 3.4.0 contains a null pointer dereference vulnerability in the hpack_dht_insert() function in src/hpack-tbl.c. The flaw occurs when hpack_dht_defrag() returns null due to memory pool exhaustion and its return value is not validated. An attacker can exploit this by triggering HPACK dynamic table insertions under memory pressure, causing HAProxy worker processes to crash and resulting in denial of service.

HAProxy up to version 3.4.0 contains an integer overflow vulnerability in the fcgi_conn structure's drl field. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect buffer parsing as new FCGI record headers. This allows malicious FastCGI backends to desynchronize the FCGI framing parser.

The EPDS and EDS systems do not verify client-provided values for the 'epds_role_id' parameter, allowing a remote, authenticated attacker to escalate their own privileges.

A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.

InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a buffer overflow vulnerability in the device registration function. This vulnerability could allow an attacker to cause a denial of service attack on the remote target device.

CometD is a scalable comet implementation for web messaging. In versions 5.0.0 through 5.0.22, 6.0.0 through 6.0.18, 7.0.0 through 7.0.18, and 8.0.0 through 8.0.8, bad clients may cause the unacknowledged message queue to grow indefinitely, leading to an `OutOfMemoryError`. Versions 5.0.23, 6.0.19, 7.0.19, and 8.0.9 patch the issue.

AutoGPT prior to version 0.6.63 has an issue with disk space management as `MediaDurationBlock` downloads and stores video in a temporary directory without deleting it after processing. `StepThroughItemsBlock` allows for multiple iterations of `MediaDurationBlock`, which can lead to disk space exhaustion.

AutoGPT prior to version 0.6.63 has an issue with disk space management as it does not delete video and audio files from the temporary directory. Additionally, the `StepThroughItemsBlock` does not limit the number of iterations, which can lead to disk space exhaustion.

AutoGPT is a workflow automation platform that prior to version 0.6.63 had an issue with the ScreenshotWebPageBlock storing screenshots in a temporary directory. The StepThroughItemsBlock did not limit the number of iterations, which could lead to disk space exhaustion and a DoS attack.

In AutoGPT prior to version 0.6.63, the `StepThroughItemsBlock` allowed iterating through all list items and downloading them via `FileStoreBlock`, which could lead to disk space exhaustion.

AutoGPT is a workflow automation platform that prior to version 0.6.63 had a vulnerability in the LoopVideoBlock component, allowing unlimited looping of video files. This led to the potential exhaustion of disk space, resulting in a DoS attack.

In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded, which could override or extend the AI agent's system prompts. An attacker could craft a malicious repository containing prompt template files that, when the workspace was opened in Theia, replaced the AI's system instructions with attacker-controlled content.