CVE Vulnerability Catalog

A vulnerability in Sonatype Nexus Repository allows a remote unauthenticated attacker to perform credential-guessing attacks against user accounts via authentication endpoints.

In version 0.2.6 of the tmp library for node.js, there is a vulnerability that allows bypassing the _assertPath guard. This enables an attacker to create a file or directory in a location controlled by them, using incorrect type values that are not strings.

The tmp package for node.js prior to version 0.2.6 contained a path traversal vulnerability that allowed escaping the intended temporary directory. Attackers could exploit traversal sequences or path separators to create files in attacker-controlled locations.

A vulnerability in Axios (versions before 0.32.0 on 0.x and before 1.16.0 on 1.x) fails to escape regex metacharacters in the XSRF cookie name. An attacker who can influence the cookie name passed to Axios can cause expensive regex backtracking while reading document.cookie, leading to client-side availability degradation (e.g., freezing the browser tab).

Vulnerability in Axios library (HTTP client for browser and Node.js). In versions from 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability has already polluted Object.prototype.transformResponse, Axios may treat that value as request configuration.

Axios versions 1.0.0 to before 1.16.0 are vulnerable to a Prototype Pollution Gadget attack. An attacker can escalate Object.prototype pollution into a full Man-in-the-Middle (MITM) attack, intercepting and modifying all HTTP traffic including credentials.

In Axios prior to versions 0.32.0 and 1.16.0, IPv4-mapped IPv6 addresses are not normalized. When NO_PROXY lists an IPv4 address, a request using the IPv4-mapped IPv6 form still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy.

Axios versions 1.7.0 through 1.15.x do not enforce configured request and response size limits when using the fetch adapter. This can lead to server resource exhaustion.

In Axios, a promise-based HTTP client for browser and Node.js, prior to versions 0.32.0 and 1.16.0, the Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage where an initial request is sent through an authenticated HTTP proxy, followed by a redirect to a URL that is no longer proxied. The final origin may receive the proxy credential.

Axios, an HTTP client for Node.js, can leak proxy credentials to a redirect target. When a request is sent through an authenticated proxy, a Proxy-Authorization header is added and persists after a redirect, even if the new request no longer goes through that proxy.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege.

IBM Langflow OSS versions 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive information by bypassing authentication using insecure direct object references.

A path traversal vulnerability in Perry before 0.5.1159 allows a malicious build server to write arbitrary content to any location writable by the client process. Attackers controlling the server URL can deliver traversal payloads through the artifact_name or download_path fields in ArtifactReady WebSocket messages.

openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details by supplying an arbitrary mail_id value.

Boruta, an authorization server, prior to version 0.9.1, sets session cookies and the 'remember me' cookie without the Secure attribute. In HTTP connections, an attacker could intercept these cookies, leading to the ability to impersonate the user.

Keras versions prior to 3.14.0 are vulnerable to a path traversal issue during archive extraction. Validation functions compare archive member paths against the current working directory (CWD) instead of the actual extraction destination, which in environments like Docker, CI/CD, or Jupyter (where CWD is '/') allows bypassing security checks and writing files outside the intended directory.

A local privilege escalation vulnerability exists in Check Point Identity Agent Full for Windows OS. An authenticated local user may be able to execute arbitrary code with SYSTEM privileges due to improper handling of executable resolution during the log collection process.

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2. Under certain conditions, an authenticated user could have added unauthorized email addresses to a targeted user's account due to improper sanitization of user-supplied input in certain group setting fields.

Golem OEE MES is vulnerable to an unauthenticated path traversal flaw. An attacker in the same local network can read arbitrary files from the server's operating system by manipulating HTTP request paths.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2. Under certain conditions, this could have allowed an unauthenticated user to cause denial of service due to improper input validation in the API request parsing middleware.