CVE Vulnerability Catalog

Orval before 8.21.0 unsafely encodes single quotes in schema property names in generated MSW mock factories, allowing malicious JavaScript execution when the factory is called.

Orval from 8.19.0 to 8.21.0 unsafely encodes double quotes in schema property names in generated zod.object({...}) schemas, allowing malicious JavaScript execution when the module is imported.

Orval before 8.21.0 unsafely encodes double quotes in query parameter names in generated request-validation zod.object({...}) schemas, allowing malicious JavaScript execution when the module is imported.

Orval before 8.21.0 unsafely encodes double quotes in header parameter names in generated request-validation zod.object({...}) schemas, allowing malicious JavaScript execution when the module is imported.

In the cluster-proxy-addon component of Multicluster Engine for Kubernetes, an unauthenticated attacker with access to the user-facing route can bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster.

In FreeRDP before 3.28.0, freerdp_dsp_decode_opus calls Stream_EnsureRemainingCapacity on the context buffer even though opus_decode writes to the caller-supplied stream. A malicious RDP server negotiating WAVE_FORMAT_OPUS can cause large decoded frames to be written beyond the allocated buffer, leading to client heap corruption, crash, and potential code execution.

Orval before 8.21.0 unsafely encodes unescaped backticks in servers[0].url in generated request URL template literals when output.baseUrl.getBaseUrlFromSpecification is enabled, allowing malicious JavaScript execution when a generated function is called.

Orval before 8.21.0 unsafely encodes unescaped backticks in OpenAPI paths in generated request URL template literals for axios, fetch, react-query, and SWR clients, allowing malicious JavaScript execution when a generated function is called.

In FreeRDP before 3.27.0, rpc_client_recv_fragment ensures response reassembly stream capacity using only the server-declared alloc_hint rather than the actual StubLength. A malicious TS Gateway can send a response with a small alloc_hint and a much larger frag_length, causing a buffer overflow in the pdu->s buffer. This can crash the client and may permit code execution.

In FreeRDP before 3.27.0, clients negotiating RDPGFX AVC444 calculate the intermediate YUV444 allocation size using 32-bit multiplication in avc444_ensure_buffer. A malicious RDP server can supply surface dimensions causing integer wrap, leading to an undersized buffer allocation. This can cause a client crash and may permit code execution.

Elementor Pro up to version 4.2.1 contains an unrestricted upload of dangerous file type vulnerability, allowing the use of malicious files.

vsDesk contains an insecure deserialization vulnerability that allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account.

FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). The librist_read() function ignores its size argument and copies the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload.

A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount arbitrary secrets into a search container's environment or replace the container image with an attacker-controlled one, leading to privilege escalation and potential full cluster compromise.

In Wazuh from 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of process_files_from_worker() in framework/wazuh/core/cluster/master.py trusts a peer-controlled file_path key from files_metadata.json. The destination is joined to WAZUH_PATH without proving that it remains inside the directory selected by cluster_item_key. A cluster peer holding the shared Fernet key can upload a crafted extra-valid archive and overwrite security-sensitive files such as /var/ossec/etc/ossec.conf, leading to code execution after a service reload.

In Wazuh from 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.send_tmp_file() in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controlled tmp_file value to WAZUH_PATH without canonicalization or confinement. A cluster peer holding the shared Fernet key can use traversal or an absolute path to make the master return any readable file over the cluster channel. Reading /var/ossec/api/configuration/security/private_key.pem allows the peer to forge administrator REST API tokens offline and then exercise administrative privileges without creating an account.

In Wazuh from 4.0.0 until 4.14.6 and 5.0.0-beta3, cluster.unmerge_info() in framework/wazuh/core/cluster/cluster.py constructs paths from peer-controlled merge_type and name values in a merged synchronization archive. process_files_from_worker() in framework/wazuh/core/cluster/master.py does not adequately confine the resulting path to the declared cluster item directory. A cluster peer holding the shared Fernet key can use traversal in files_metadata.json or a merged-file header to write files such as /var/ossec/etc/ossec.conf, leading to code execution when Wazuh services reload.

Vulnerability in Cisco Crosswork related to insufficiently protected credentials (CWE-522). It was discovered during an internal security review and addressed in a hardening release.