CVE Vulnerability Catalog

RFC 5322 comments can be nested, but addressparser ends a comment at the first `)`, including the one closing a nested comment, and parses the remainder of the outer comment as header text. This leads to incorrect email address interpretation.

In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking entry.

A flaw was found in the OpenJPEG project where a heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress utility. This can lead to an application crash or other undefined behavior.

Vulnerability in CUPS printing system versions 2.4.8 and earlier. When starting the cupsd server with a Listen configuration pointing to a symbolic link, the process can perform an arbitrary chmod on the target file.

Vulnerability in GNU Wget up to version 1.24.5. The url.c function mishandles semicolons in the userinfo component of a URI, potentially leading to misinterpretation of data as part of the host.

Incomplete fix for CVE-2022-31629 in PHP. Network or same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.

Vulnerability in PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5. If a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() incorrectly returns true.

Logic error in PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8. Filtering functions like filter_var when validating URLs (FILTER_VALIDATE_URL) for certain URL types return invalid user information (username+password part of URLs).

Parsing error in multipart/form-data in PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12. Erroneous parsing can lead to legitimate data not being processed, and an attacker can control part of the submitted data.

Vulnerability in PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14. A hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server.

A partial fix for CVE-2024-39884 in Apache HTTP Server 2.4.61 ignores some legacy content-type based configurations like AddType. Under certain circumstances with indirect file requests, this can lead to source code disclosure of local content.

In less through version 653, improper quoting in filename.c allows OS command execution via a newline character in a file name. Exploitation typically requires attacker-controlled file names, such as from untrusted archives.

The Apache Portable Runtime library on Unix platforms sets lax permissions on named shared memory segments, allowing local users read access and potentially revealing sensitive application data. This issue does not affect non-Unix platforms or builds with APR_USE_SHMEM_SHMGET=1.

The execute_filter_audio function in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.

The execute_filter_delta function in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.

In GNU C Library versions 2.13 to 2.40, when the assert() function fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.

In GNU C Library versions 2.27 to 2.38, an untrusted LD_LIBRARY_PATH environment variable vulnerability allows attacker-controlled loading of dynamically shared libraries in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions).

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to the ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI with catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from log messages by manipulating the log message.

In PHP from 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, 8.4.* before 8.4.5, when requesting an HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect.