CVE Vulnerability Catalog

The touch utility in uutils coreutils is vulnerable to a TOCTOU race condition during file creation. After identifying a missing path, the utility later attempts creation using File::create(), which internally uses O_TRUNC. An attacker can exploit this window to create a file.

An improper initialization vulnerability in the AMD Secure Encrypted Virtualization (SEV) firmware allows an admin-privileged attacker to corrupt RMP-covered memory, potentially leading to loss of guest memory integrity.

A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the destination path before recreating it through a copy operation, which a local attacker with write access to the destination directory can exploit.

The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically resulting in a world-readable file (0644).

A TOCTOU vulnerability in the cp utility of uutils coreutils allows an attacker to bypass the intended no-dereference behavior. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag.

The 'id' utility in uutils coreutils incorrectly displays data in 'pretty print' mode when the real UID differs from the effective UID. The implementation mistakenly uses the effective GID instead of the effective UID when looking up the name of the effective user, leading to misleading output.

The cp utility in uutils coreutils is vulnerable to an information disclosure race condition. Destination files are initially created with umask-derived permissions (e.g., 0644) before being restricted to their final mode (e.g., 0600) later in the process. A local attacker can race to open the file before the permission change.

A TOCTOU vulnerability in the split utility of uutils coreutils allows an attacker to replace the output file between the check and use, potentially leading to data loss. The flaw occurs because the program checks file identity based on paths but later opens the file without re-verification.

The mongo-go-driver contains a heap out-of-bounds read vulnerability in the CGo implementation for GSSAPI (Kerberos) authentication on Linux and macOS. The issue arises from incorrect assumptions about string termination in the GSSAPI standard, potentially leading to data disclosure.

`NestedSecretsSettingsSource` reads secret values from files in a configured `secrets_dir`. When `secrets_nested_subdir=True`, a directory entry inside `secrets_dir` that is a symbolic link pointing outside `secrets_dir` is followed, allowing access to files outside the configured directory.

Granian is a Rust HTTP server for Python applications. From versions 0.2.0 to 2.7.4, Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value.

An issue was discovered in versions 6.0 before 6.0.5 and 5.2 before 5.2.14 related to ASGI requests that can bypass the `FILE_UPLOAD_MAX_MEMORY_SIZE` limit when the `Content-Length` header is missing or understated. This may lead to large files being loaded into memory, causing service degradation.

A vulnerability in the Go standard parser causes a panic when processing source code with deeply nested literals. The issue stems from stack exhaustion during recursive parsing.

Vulnerability in the PDO PostgreSQL driver for PHP causes an invalid character sequence (e.g., \x99) in a prepared statement parameter to lead to quoting errors when PDO::ATTR_EMULATE_PREPARES is enabled. Affects PHP versions 8.1.x before 8.1.34, 8.2.x before 8.2.30, 8.3.x before 8.3.29, 8.4.x before 8.4.16, and 8.5.x before 8.5.1.

A vulnerability in the XML::Parser library for Perl (up to version 2.45) causes a heap buffer overflow, leading to double free or corruption and crashes. The issue occurs in the parse_stream() function in Expat.xs when the :utf8 PerlIO layer is used, because Perl returns decoded characters while SvPV() expects raw bytes.

Loofah's HTML5 sanitizer restricted only the xlink:href attribute on certain SVG elements to local, same-document references. Browsers also accept a plain href attribute as an alternative to the deprecated xlink:href per the SVG 2 spec, but Loofah did not apply the same restriction to it.

There is a possible cross-site scripting vulnerability in rails-html-sanitizer when the sanitizer is configured to allow an SVG reference element such as <use>. This is related to GHSA-9wjq-cp2p-hrgf in Loofah, whose SVG local-reference logic rails-html-sanitizer mirrors.

Faulty input validation in the core of Apache HTTP Server through 2.4.58 allows malicious or exploitable backend/content generators to split HTTP responses, leading to HTTP response splitting attacks.

In the Linux kernel, a vulnerability in KVM for AMD SEV-SNP was found. During SNP launch finish, the synchronization and encryption of VMSA (Virtual Machine Save Area) does not lock all vCPUs, allowing userspace to manipulate or run a vCPU while its state is being synchronized.

In the Linux kernel, a vulnerability was found in the mechanism preventing timer interrupt starvation. Missing resets of the next_event_forced flag in several places, such as when the clock event state changes, may cause incorrect behavior.