CVE Vulnerability Catalog

modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal(). Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar() that buffers chunks indefinitely, exhausting process memory and suppressing later entries.

IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing __proto__, constructor or prototype key segments. Attackers can pass [__proto__] or [constructor.prototype] table headers or __proto__.x dotted keys to parse() to pollute all objects, causing denial of service or authorization bypass.

Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending URL-encoded dot segments. Attackers can send %2e%2e/ sequences, which decodeURI() decodes before path.join() in serveStaticFile and serveDirectoryListing, to read arbitrary files and list directories outside the root.

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and process memory.

easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $() or backticks, which child_process.exec() runs through a shell with the Node.js process privileges.

containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing the destination ContainerConfig. An attacker who can create a container from a crafted checkpoint can supply restored credentials, capabilities, no_new_privs, and seccomp state. The restored process can run as root with full capabilities and no enforced seccomp filters while CRI status reports the requested configuration. Systems that do not use CRI checkpoint restore are not affected. This issue is fixed in versions 2.2.7 and 2.3.4.

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGS_POST without enforcing the cap. The flaw is triggered when an unauthenticated attacker sends more arguments than SecArgumentsLimit or supplies bodies that expand beyond the configured argument and flattening budgets. An unauthenticated attacker can flood requests with arguments so excess values are silently omitted from ARGS, ARGS_GET, ARGS_NAMES, ARGS_GET_NAMES, ARGS_POST, or ARGS_PATH before security rules inspect them; affected urlencoded and JSON processing can also consume excessive memory. The omission can bypass WAF rules protecting the downstream application, and unbounded or amplified argument processing can cause memory consumption and service degradation. This issue is fixed in version 3.8.1.

NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or consult any Windows certificate trust store. Attackers can perform a man-in-the-middle attack using a rogue certificate authority to decrypt traffic, capture the MUSIC_U session credential sent in authenticated API requests, and modify server responses in transit, enabling account takeover and transport-layer response forgery.

NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to inject content into the renderer, such as by forging the /pc/upgrade/get API response using a publicly known AES key over an unvalidated TLS connection, can invoke os.navigateExternal with a file:// URL through an img onerror payload to execute arbitrary local binaries under the logged-in user's account.

Privasys Remote Attestation TLS Clients before 0.9.1 performs attestation only once, at connection establishment time. An attacker with local access can modify workload code, data, and configuration at any time after the connection is established, while the verifying peer continues to trust the initial Evidence.

A fail-open flaw was found in openstack-network-exporter: when user authentication is configured but TLS is omitted or misconfigured, basic authentication is silently bypassed. An adjacent network attacker can then access OVS and OVN dataplane metrics without credentials.

In PHPCSUtils from 1.0.0-alpha1 until 1.2.3, AbstractArrayDeclarationSniff::getActualArrayKey() evaluates attacker-controlled array-key expressions with eval(). This allows callback-form keys in untrusted PHP code scanned by an extending sniff to execute arbitrary commands on the scanning host.

In ConvertX before 0.18.0, the /delete/{id} endpoint uses HTTP GET for permanent deletion without CSRF protection. If an authenticated user visits attacker-controlled content, the browser sends the session cookie and deletes the targeted job.

In ConvertX before 0.18.0, the ImageMagick converter uses the unsanitized convert_to parameter to construct an output path. An authenticated user (or unauthenticated when access is allowed) can upload an extensionless image and supply directory traversal sequences in convert_to via /convert, writing output outside the intended directory.

In PraisonAI before praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter directly to requests.get without validating scheme, host, port, or resolved address. Prompt-injected content can direct the search tool to internal JSON services, distinguish open and closed internal ports, and attempt cloud-metadata requests.

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (including DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitive information due to improper authorization when using the CREATE WRAPPER command.

A vulnerability was detected in KusalkaSilva Learning-Management-System up to commit ffeb873f8803f1e9664384ff75000c7da45466d2, affecting the mysql_query function in remove_announcements.php. Manipulating the ID argument results in missing authentication, and the attack can be performed remotely; the exploit is publicly available.

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance. The flaw allows an attacker to gain elevated privileges on the system.

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (including DB2 Connect Server) could allow a local attacker to gain elevated privileges due to improper privilege management.