CVE Vulnerability Catalog

In the russh library, which is a Rust SSH client and server, prior to version 0.60.1, there is a pre-authentication denial-of-service vulnerability in the keyboard-interactive authentication handler. A malicious client can crash any russh-based server implementing this authentication by sending a single malformed packet.

An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2 that could allow arbitrary classes to be loaded and executed when processing JDBC connection URL parameters.

A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. This can lead to DoS or local privilege escalation when an authenticated cPanel user places a symlink at a user-controlled legacy Nova path under their home directory.

Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated account's system user.

Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can lead to arbitrary file read when a relative file path is passed.

Crypt::PasswdMD5 versions up to 1.42 for Perl generate insecure random values for salts. The built-in rand function is predictable and unsuitable for cryptographic use.

ZEBRA, a Zcash node written in Rust, prior to version 4.4.0 had a composite denial-of-service vulnerability in its block discovery process. An unauthenticated remote attacker could permanently halt new block discovery on a targeted node by exploiting three independent weaknesses.

The vulnerability in absinthe-graphql absinthe related to inefficient algorithmic complexity allows unauthenticated denial of service via quadratic fragment-name uniqueness validation.

A vulnerability in absinthe-graphql allows unauthenticated denial of service via atom table exhaustion when parsing attacker-controlled GraphQL SDL. Multiple Blueprint.Draft.convert/2 implementations in Absinthe's SDL language modules call String.to_atom/1 on attacker-controlled names, leading to resource exhaustion.

i18next-http-middleware prior to version 3.9.3 passed user-controlled lng and ns values without proper sanitization, potentially allowing for path traversal or SSRF attacks.

In versions prior to 4.0.21, the locize client SDK registers a 'message' event handler that does not validate event.origin, allowing attackers to invoke internal handlers via crafted messages.

OmniFaces, a utility library for Faces, prior to versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3, contains a server-side EL injection vulnerability leading to Remote Code Execution (RCE). An attacker can craft a resource request URL containing an EL expression in the resource name, which is evaluated server-side.

i18next-fs-backend prior to version 2.6.4 has a vulnerability that allows unencoded and unvalidated values to be injected into file paths, enabling an attacker to read or overwrite files outside the intended locale directory.

Versions of 18next-http-middleware prior to 3.9.3 allow an unauthenticated HTTP client to pollute Object.prototype in the Node.js process, leading to serious security issues.

i18next-http-middleware prior to version 3.9.3 allows injection of user-controlled language values into the Content-Language response header, potentially leading to CRLF attacks. This issue has been patched in version 3.9.3.

Akamai Guardicore Platform Agent and Zero Trust Client on Linux and macOS allow TOCTOU-based local privilege escalation. The GPA service creates an IPC socket in the world-writable /tmp directory, enabling log file manipulation by unprivileged users.

lwjson version 1.8.1 contains an improper input validation vulnerability in the JSON parser. The end-of-string detection logic incorrectly identifies escaped quote characters, leading to applications hanging when processing valid JSON strings.

An issue was discovered in kosma minmea 0.3.0, where the minmea_scan functions format specifier copies NMEA field data to a caller-provided buffer without a size parameter. Applications using minmea_scan on untrusted input are vulnerable to a stack buffer overflow.

nanoMODBUS through v1.22.0 has a stack-based buffer overflow in recv_read_registers_res() in nanomodbus.c. An attacker can send a malicious response from a Modbus TCP server, leading to buffer overflow and potential remote code execution.

ZEBRA, a Zcash node written in Rust, prior to version 4.4.0, incorrectly counts transparent signature operations against the 20000-sigop block limit, allowing it to accept blocks that zcashd rejects. This can lead to network splits.