CVE Vulnerability Catalog

Malcolm's upload-processing pipeline enforces limits on container archives but not on single-stream compressed formats. An authenticated user can upload a small, highly compressible file that decompresses to an unbounded size, exhausting the shared Docker volume and disrupting the platform.

Malcolm's nginx Lua RBAC layer matches patterns against the raw, percent-encoded request URI, while nginx routes requests using the decoded URI. This allows an authenticated low-privilege user to access admin-only paths by percent-encoding the path, bypassing restrictions.

The Sierra Wireless HL7800 cellular modem driver (up to v4.4.0) contains a vulnerability involving out-of-bounds writes on the stack while parsing AT responses. Most handlers write a NUL terminator one byte past the end of a 128-byte buffer, while the +KCELLMEAS handler allows a full stack buffer overflow with data from response lines longer than 128 bytes.

Lemur before version 1.9.3 contains a vulnerability in _validate_revocation_url that does not properly validate URLs after HTTP redirects, allowing access to internal addresses (loopback, RFC1918, link-local, instance-metadata). Additionally, there is a time-of-check time-of-use window enabling DNS rebinding attacks. An operator uploading a certificate via POST /api/1/certificates/upload can trigger unwanted internal requests.

Vitess version 24.0.2 and earlier has a vulnerability in the /debug/vrlog endpoint that does not check ACL permissions (missing acl.CheckAccessHTTP). A remote attacker with access to the vttablet debug HTTP port can bypass the security policy and stream VrLogStats data, including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and Online DDL workflows.

Lemur before version 1.9.2 has a vulnerability that allows authenticated users to influence the ACME authority URL (acme_url) without effective server-side destination restriction, enabling SSRF attacks on internal services or cloud metadata. Additionally, there is an authorization weakness that could preserve access to private keys after ownership changes.

Lemur before version 1.9.2 has a vulnerability in the JWT verifier that uses an unverified algorithm from the token header. In the default configuration, PyJWT rejects alg=none, so it is not a direct authentication bypass, but it is a defense-in-depth gap. After migration to asymmetric signing, algorithm confusion may occur, and algorithm-based anomaly detection is weakened.

Lemur before version 1.9.2 has a vulnerability in lemur.users.service.update that assigns a replacement password directly to users.password, without invoking hash_password (registered only for the before_insert event). As a result, administrator-initiated password changes via PUT /api/1/users/ are stored in plaintext, preventing normal login and exposing passwords.

Lemur before version 1.9.2 has a vulnerability in PUT /api/1/roles/ that authorizes updates based on role membership rather than administrator-only. This allows a non-admin member to add or remove other users and rename the role, potentially leading to privilege escalation and denial of access.

Lemur before version 1.9.2 has a vulnerability in lemur/certificates/verify.py that accepts CRL and OCSP URLs from uploaded certificates without adequate destination validation. An authenticated operator can upload a certificate via POST /api/1/certificates/upload and cause verify_string to reach internal addresses such as loopback, RFC1918, link-local, or instance-metadata (e.g., 169.254.169.254). Additionally, the CRL path uses an unbounded cache, potentially leading to memory exhaustion.

NVIDIA Triton Inference Server for Linux contains a vulnerability that allows an attacker to cause an absolute path traversal. A successful exploit might lead to code execution.

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause improper input validation. A successful exploit might lead to denial of service.

NVIDIA Triton Inference Server for Linux contains a vulnerability that allows an attacker to cause unlimited resource allocation. Successful exploitation may lead to denial of service.

NVIDIA Triton Inference Server for Linux contains a vulnerability that allows an attacker to perform path traversal, potentially leading to denial of service.

NVIDIA Triton Inference Server for Linux contains a vulnerability that allows an attacker to cause an absolute path traversal. A successful exploit might lead to code execution and information disclosure.

NVIDIA NVOS for network switches contains a vulnerability in the SSH server configuration when PKA-only mode is enabled. An administrator may inadvertently enable an alternative authentication path, which, if default passwords are not changed, could lead to unauthorized access and privilege escalation.

NVIDIA Cumulus Linux contains a vulnerability in the LLDP daemon, where an unauthenticated attacker on an adjacent network could cause a buffer overflow by sending crafted LLDP frames. Successful exploitation may lead to code execution.

NVIDIA Cumulus Linux contains a vulnerability in the user management component, where an unprivileged user could exploit improper privilege management. Successful exploitation may lead to privilege escalation.

The tar extraction routines in moby/go-archive do not confine filesystem operations to the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.

Otalio Ship Property Management System before version 2.22.0 contains a vulnerability due to unescaped stored values in the application security page. Authenticated attackers can escalate privileges via persistent cross-site scripting (XSS).