CVE Vulnerability Catalog

A vulnerability in Libevent before versions 2.1.13 and 2.2.2-alpha includes two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause path truncation and bypass validation. evhttp_header_is_valid_value also accepts obsolete line folding in header values containing CR or LF, allowing a proxy and libevent to interpret headers differently.

Libevent before versions 2.1.13 and 2.2.2-alpha inconsistently handles duplicate Transfer-Encoding headers, comma-separated values, and bare line feeds in chunked framing. This can lead to request desynchronization and request smuggling by an unauthenticated remote attacker when deployed behind a proxy.

A vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it. Samly does not enforce the single-use requirement because it never calls the duplicate-checking function.

In vsDesk v14.0101, an authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to lack of server-side validation. This allows uploading arbitrary files, potentially leading to Remote Code Execution (RCE) within the web application context.

In Comfast CF-N1-S version 2.6.0.1, the function sub_44B438 in /cgi-bin/mbox-config?method=SET&section=ptest_ssid (SSID Configuration component) has a stack-based buffer overflow via the ssid argument.

In the unstructured library (from 0.4.7 to 0.24.0), the url argument in partition, partition_html, and partition_md is fetched without host validation, allowing an attacker to access loopback addresses, internal HTTP services, or cloud metadata endpoints.

In dbx (prior to 0.5.51), auth_middleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when password_hash is None. A fresh deployment reaches that state when DBX_PASSWORD is unset, and the service binds to 0.0.0.0 on port 4224 by default.

OSNEXUS QuantaStor has a remote code execution vulnerability due to missing authentication in the configuration of Kapacitor. Authentication is not required to exploit this vulnerability.

SQL Injection vulnerability in Apache InLong. An attacker can inject a string value into the SQL statement, enabling SQL injection. Affects versions from 2.0.0 before 2.4.0.

SQL Injection vulnerability in Apache InLong. An attacker can inject arbitrary SQL code through the dbName, tableName, schemaName, and username parameters. Affects versions from 2.0.0 before 2.4.0.

SQL Injection vulnerability in Apache InLong. It allows SQL injection in the ORDER BY clause against the Manager backend database. Affects versions from 2.0.0 before 2.4.0.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary files due to improper neutralization of special elements in input.

Baylan Smart Meter Management Application (BMS) before v1.1.10.142 has a missing authentication for critical function vulnerability, allowing authentication bypass.

Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons. Allows an attacker to perform unauthorized actions on behalf of a logged-in user. Affects versions up to 2.3.7.

Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSyntax() and runPlaywrightTest() functions unsafely interpolate caller-controlled absolutePath values into shell commands, enabling arbitrary OS command execution when an AI agent is induced to invoke these tools. Commit 88c77fc fixes these vulnerabilities.

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and Update operations, which built filter queries by concatenating an expression-bindable value without escaping. An attacker could inject a condition that widened the filter to match every row, turning an intended single-row operation into full-table disclosure, deletion, or modification.

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vulnerability in the MongoDB node's Find, Delete, and Aggregate operations, which parse the Query parameter as JSON after expression resolution without sanitizing MongoDB operators. An attacker who can influence the resolved query (e.g., via externally-controlled data) can inject operators such as $ne or $where, turning an intended single-document lookup into full-collection disclosure, full-collection deletion, or other operations on the database server.

Vulnerability allowing arbitrary file upload by users with Subscriber role in the Warehouse Cargo plugin. Affects versions up to 2.6.9.

Vulnerability allowing arbitrary file upload by users with Subscriber role in the Smart Cleaning plugin. Affects versions up to 4.8.6.

Vulnerability allowing arbitrary file upload by users with Subscriber role in the IT Residence plugin. Affects versions up to 3.2.1.