CVE Vulnerability Catalog

zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition arguments. Attackers can supply negative offset values that bypass bounds checks and reach the native frame-header parser.

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(). This allows an attacker to trigger an infinite loop that holds the stream monitor and blocks all other threads from accessing the stream.

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header. Attackers can split the header across multiple lines or use values like 'chunked, xchunked' to bypass validation and decode messages incorrectly.

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity.

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures.

AnythingLLM 1.16.1 and earlier allows the manager role to store meta_page_title or meta_page_favicon values via /api/admin/system-preferences, which MetaGenerator inserts into production homepage HTML without escaping. The values pass unchanged through systemSettings.js and reach MetaGenerator.generate() in server/index.js.

Tesseract 5.5.3 and earlier contains a flaw in Plumbing::DeSerialize that accepts a zero-length stack for NT_SERIES, NT_PARALLEL, or NT_REVERSED layers in a crafted .traineddata model. During LSTMRecognizer initialization, CacheXScaleFactor dereferences stack_[0] on the empty vector and invokes a virtual method through an invalid Network pointer.

Tesseract version 5.5.3 and earlier contains a heap overflow vulnerability in Classify::ReadIntTemplates, which reads NumClassPruners, NumClasses, and NumProtoSets from a .traineddata file without validating them against MAX_* limits. Oversized values cause out-of-bounds pointer writes on the heap during classifier initialization.

Tesseract version 5.5.3 and earlier contains a heap overflow vulnerability in UNICHARSET::load_via_fgets, which trusts the declared unichar count as a loop bound and uses id as an unchecked index into the unichars vector. This can lead to out-of-bounds writes during initialization.

Tesseract version 5.5.3 and earlier contains a heap overflow vulnerability in GenericVector::read, which reads reserved and size_used_ fields from a .traineddata file without caps. A crafted file can set reserved to a small value and size_used_ to a large value, causing out-of-bounds writes of FontInfo structures.

The GridFS component of the MongoDB Go Driver contains an improper neutralization of special elements in data query logic, where a caller-supplied structured file identifier can be interpreted as a query condition rather than a literal identifier. An authenticated user who can influence the identifier may cause all GridFS file chunks in the affected bucket to be removed.

The GridFS component of the MongoDB Ruby Driver contains an improper neutralization of special elements in data query logic, where a caller-supplied structured file identifier can be interpreted as a query condition rather than a literal identifier. An authenticated user who can influence the identifier may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed.

The GridFS component of the MongoDB Python Driver contains an improper neutralization of special elements in data query logic, where a caller-supplied structured file identifier can be interpreted as a query condition rather than a literal identifier. An authenticated user who can influence the identifier may obtain stored file content beyond the intended target, cause all GridFS file chunks in the affected bucket to be removed, or rename a stored file other than the intended target.

The MongoDB integration for Laravel contains improper neutralization of special elements in data query logic within polymorphic relation handling. A caller-supplied relation identifier can be interpreted as a query condition rather than as a literal identifier.

The MongoDB integration for Laravel contains an improper neutralization of special elements in embedded-document relation handling, where a caller-supplied embedded record identifier can be interpreted as a query condition rather than a literal identifier. An authenticated user who can influence such an identifier may delete all embedded documents in a targeted record or overwrite an embedded document other than the intended target.

The MongoDB C# Driver contains improper neutralization of regular-expression metacharacters in the LINQ query translation component. A caller-supplied character sequence can alter a regular-expression predicate generated by an affected application.

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target, cause all GridFS file chunks in the affected bucket to be removed, or rename a stored file other than the intended target.

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target, cause all GridFS file chunks in the affected bucket to be removed, or rename a stored file other than the intended target.

Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argument `where` method when the operator is `=` or `eq`, as well as the `find` and `delete` methods that use that code path.