CVE Vulnerability Catalog

Reflected Cross-site Scripting (XSS) vulnerability in the aBlocks plugin by Kodezen LLC. Improper input neutralization during web page generation allows an attacker to inject malicious scripts.

Prototype pollution vulnerability in the dot-access library up to version 1.0.0. An attacker controlling the path (e.g., via user-supplied field names) can use __proto__ segments to inject properties into all objects.

Vulnerability in MariaDB Connector/Node.js before versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4. When using the text protocol, escaping always prefixes quotes with a backslash and does not honor the NO_BACKSLASH_ESCAPES mode, allowing SQL injection via an attacker-controlled value.

Vulnerability in MariaDB Connector/Node.js from 3.2.0 to 3.2.5, 3.3.4, 3.4.7, and 3.5.4. When permitSetMultiParamEntries is enabled, object keys are expanded into a SQL SET clause without being processed by escapeId, allowing SQL injection via a key containing a backtick.

Vulnerability in MariaDB Connector/Node.js before versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4. The GeoJSON Polygon and MultiPolygon binary encoders allocate memory via Buffer.allocUnsafe() based on each ring's numeric length before confirming the ring is an array, potentially disclosing uninitialized Node.js heap data.

An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper via a crafted database command value introduced in the agent context.

Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document, can cause invalid memory access and invalid frees in the client process.

In OpenStack Mistral through 23.0.0, several v2 API write paths resolve the target object with a query that can return another project's resource, then write to it. An authenticated project member can use this to rewrite and un-publish another project's public action definitions and environments.

In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state.

In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyCommand() before any SSH connection is attempted. An authenticated project member can use the standard action-execution API to submit an arbitrary local command as proxy_command, which is started as a subprocess on the executor host. Only deployments that permit the std.ssh_proxied action, the default configuration, are affected.

CairoSVG prior to 2.9.1 has a performance issue when rendering an SVG with a path containing many segments, causing quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while draw_markers drains node.vertices with pop(0), causing repeated linear-time work. The svg2png, svg2pdf, and svg2ps APIs reach these operations during ordinary rendering, allowing a sub-megabyte SVG to consume substantial CPU and deny service.

datamodel-code-generator from 0.59.0 until 0.81.0 has a vulnerability where an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAK_IMPORT_PATTERN and consumed by _write_missing_weak_imports. Exploitation requires a victim or automated job to process the schema with Protobuf input support (grpcio-tools). The paths escape the weak_imports temporary directory, allowing creation of directory trees, new files, or overwrite of existing writable files with a generated Protobuf syntax declaration.

webonyx graphql-php prior to 15.32.3 has a stack exhaustion vulnerability in GraphQL\Language\Parser, which performs recursive descent without a recursion limit in parseSelectionSet, parseValueLiteral, and parseTypeReference. A remote attacker can submit deeply nested selection sets, object or list values, or list types that exhaust the PHP process stack during pre-validation parsing. The resulting SIGSEGV can terminate PHP-FPM workers or long-running processes.

JHipster from 7.0.0 until 9.4.0 has a vulnerability in generated reactive applications (Spring WebFlux, Spring Data R2DBC, SQL). The attacker-controlled sort request parameter is passed into createOrderByFields in EntityManager_reactive.java.ejs, and rendered into the SQL ORDER BY clause without validation or quoting. The R2DBC simple query protocol can execute additional statements separated by semicolons. A normal authenticated user can read sensitive tables, modify or delete data, or drop tables.

The Malcolm file-upload component ships the upstream FilePond PHP server largely unmodified. Upstream index.php exposes a fetch API route that instructs the server to download an arbitrary URL with curl (including FOLLOWLOCATION) and, for HEAD requests, stores the fetched response body in the transfer directory and returns the transfer ID, enabling full readback of the fetched content.

The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS. An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wipe which permanently deletes all captured network traffic and forensic logs, or control.py --stop which blinds the security monitoring.

Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based RBAC authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatted request path to bypass role-based restrictions and reach administrative or role gated endpoints they should not have access to, including file upload, PHP server, htadmin, and authentication management interfaces.

JHipster prior to generator-jhipster 9.4.0 and react-jhipster 1.1.0 has a vulnerability where generated applications can persist attacker-controlled Blob data and companion ContentType values, return them through REST endpoints, and pass them to the generated openFile helper. The helper uses the returned ContentType as the browser Blob MIME type and opens an object URL, so a normal authenticated user with write access to a Blob-bearing entity can store active HTML or SVG content that may execute under the application origin when a privileged user opens it.

msgpack5 prior to 6.1.0 has a vulnerability where the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError, which can unexpectedly terminate a request, stream, or worker in applications that wait for additional bytes after IncompleteBufferError.

An authorization flaw in Zimbra Collaboration Suite's GrantRightsRequest allows an attacker with access to an authenticated account to grant another local account the loginAs right, creating persistent mailbox access and mail-sending authority that survives password changes and session expiry.