CVE Vulnerability Catalog

A vulnerability in MariaDB allows a malicious joiner node to execute arbitrary shell commands on the donor node during the SST (Snapshot State Transfer) process using the mariabackup method. The issue is caused by insufficient validation of parameters sent by the joiner, which are interpolated into the command line on the donor side.

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, and 10.11.x <= 10.11.16 fail to require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints, allowing a user with group-link permissions to escalate themselves and group members to team or channel admin via crafted API requests.

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, and 10.11.x <= 10.11.16 have a vulnerability that allows improper processing of the FileInfo.Name received from federated peers. An attacker controlling a federated server can exploit this vulnerability to write files to arbitrary locations within the target server's filestore via path traversal sequences in the filename field.

Cap-go prior to 12.128.2 contains an account takeover vulnerability in its email change mechanism that allows an attacker with temporary authenticated session access to change the registered email address without re-authentication. Attackers can redirect verification to an attacker-controlled email address and subsequently perform a password reset to permanently take over the victim's account.

A vulnerability in Kedro version 1.2.0 allows an attacker to exploit path traversal by providing a crafted version string. The `_get_versioned_path()` method directly interpolates user-supplied version strings into filesystem paths without sanitization, enabling access to files outside the intended dataset directory.

Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for salts. They use the built-in rand function, which is predictable and unsuitable for cryptography.

A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.

The Aqara Developer Portal (developer.aqara.com) and shared test environments (developer-test.aqara.com, aiot-test.aqara.com) have an overly permissive CORS policy, allowing unauthorized domains to make cross-origin requests. This vulnerability is classified as CWE-942 and has an estimated CVSS score of 8.2 (High).

The Aqara IAM/SSO gateway (gw-builder.aqara.com) has a cross-origin request sharing vulnerability due to a permissive cross-domain policy with untrusted domains (CWE-942), with an estimated CVSS score of 8.2 (High).

The Aqara Board service (op-test.aqara.com) accepts arbitrary MQTT command payloads and forwards them to the HiveMQ broker without authentication. This is a missing authentication for critical function (CWE-306) with an estimated CVSS of 8.6 (High). Combined with other vulnerabilities, it can lead to fully unauthenticated remote takeover of affected devices.

A vulnerability in Netty RedisArrayAggregator pre-allocates an ArrayList with a capacity equal to the RESP array element count declared in a header, which can be inflated by a malicious packet. An attacker can send a small header with a fake large element count, leading to excessive memory consumption.

Netty prior to versions 4.1.135.Final and 4.2.15.Final has a vulnerability in SimpleTrustManagerFactory that bypasses hostname verification. A client configured with SslContextBuilder.forClient().trustManager() does not validate the certificate against the hostname, even when endpointIdentificationAlgorithm="HTTPS" is set.

Netty is a network application framework. Versions from 4.2.0.Final to 4.2.15.Final contain a memory exhaustion vulnerability in the HTTP/3 codec, allowing an infinite number of blocked streams, which can cause OOM. The issue is fixed in 4.2.15.Final.

A vulnerability in Netty causes native or heap memory leak on every connection when a client sends a syntactically valid HAProxy PROXY protocol v2 header containing nested PP2_TYPE_SSL TLVs at depth two or greater. The leak occurs on the successful parse path without throwing an exception, and releasing the HAProxyMessage does not free the underlying cumulation buffer.

A vulnerability in the Netty library causes permanent leakage of pooled direct-memory buffers in the RedisArrayAggregator handler when a Redis pipeline connection closes before RESP array aggregation completes. The handler retains child messages without releasing them on channel inactivation, leading to exhaustion of the direct-memory pool. The issue is fixed in versions 4.1.135.Final and 4.2.15.Final.

A vulnerability in Netty's `DnsResolveContext` allows DNS Cache Poisoning due to insufficient validation of NS record bailiwick. An attacker controlling an authoritative DNS server for a subdomain can inject fake A records for parent domains into the cache, redirecting traffic.

A code injection vulnerability in ChromaDB version 0.4.17 and later allows an authenticated attacker with UPDATE_COLLECTION permission to execute arbitrary code on the server by sending a malicious model repository with trust_remote_code set to true.

A vulnerability in ChromaDB allows bypassing authorization controls by using V1 endpoints, which pass None for tenant and database to the authorization layer.

The SimpleRBACAuthorizationProvider in versions 0.5.0 or later of the ChromaDB Python project has a vulnerability that allows evaluating user permissions without checking which tenant, database, or collection those permissions apply to.

ChromaDB version 0.4.17 and later lacks authorization validation, allowing any authenticated user to arbitrarily read, write, update, or delete data in any tenant's collection regardless of their tenant membership.