CVE Vulnerability Catalog

Quasar Framework prior to 2.22.0 contains a vulnerability in the public extend() utility in ui/src/utils/extend/extend.js that recursively copied attacker-controlled object keys during extend(true, target, source) deep merges without rejecting an own __proto__ property. The merge could descend into the prototype object and write attacker-controlled properties to Object.prototype in the same JavaScript process. Applications that passed user-controlled or partially user-controlled objects to extend() could experience logic bypass, unsafe default-option injection, denial of service, or other application-specific impact when polluted properties were later consumed. This issue is fixed in version 2.22.0.

OpenZeppelin Confidential Contracts before version 0.3.1 has a vulnerability in the ERC7984 contract where the _mint operation can silently fail due to overflow, and the wrap and onTransferReceived functions do not handle this failure. A user can transfer the underlying token without receiving the corresponding confidential wrapped token, leading to loss of funds after approximately 18.4 trillion tokens with the default rate().

OpenDJ before 5.1.2 in the SASL PLAIN mechanism checks the PROXIED_AUTH privilege but does not evaluate the mayProxy proxy ACI scope when an authzid resolves to a different user. This allows an authenticated account with PROXIED_AUTH to assume any resolvable non-root identity outside the identities permitted by its proxy ACI. The fix returns INVALID_CREDENTIALS (49) before password verification when the target authorization identity is not permitted. This issue is fixed in version 5.1.2.

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. Fixed in version 5.2.2.

fast-xml-parser versions 5.9.3 through 5.10.1 have a vulnerability related to processing multiple DOCTYPE declarations in a single XML document. The addInputEntities() function resets entity expansion limits on each call, allowing bypass of protections and potentially causing excessive CPU usage, event-loop blocking, memory exhaustion, and process termination. The issue is fixed in version 5.10.1.

py-libp2p version 0.7.0 and earlier has a vulnerability in the handle_incoming() method in yamux, which reads an attacker-controlled DATA frame length before validation. After completing the standard Noise handshake, an adversary can send a frame with length 0xFFFFFFFF and withhold the body, blocking the yamux read loop and preventing progress on all streams of the connection. No fixed version is available as of this review.

sm-crypto before 0.5.0 in the default no-argument sm2.generateKeyPairHex() path in Node.js uses the module-wide SecureRandom instance from [email protected], which seeds an ARC4 stream from Math.random() and new Date().getTime() because window.crypto.getRandomValues is unavailable even though globalThis.crypto exists. An attacker who can observe the process's Math.random() outputs and estimate the key-generation time can reconstruct the seed, recover generated SM2 private keys, and predict signing ephemeral scalars used to forge signatures. This issue is fixed in version 0.5.0.

node-tar prior to version 7.5.21 has a vulnerability in the filesFilter function in src/list.ts, which uses the recursive mapHas helper to walk an archive entry path without a segment cap. A crafted GNU L or PAX x long-path header with thousands of segments can cause an uncatchable RangeError stack overflow, terminating asynchronous and streaming Node.js consumers. The issue is fixed in version 7.5.21.

@hono/node-server from version 2.0.0 to 2.0.10 has a vulnerability in WebSocket handling where an upgrade request with a missing or malformed Sec-WebSocket-Key header causes the request to remain in waiterMap with no cleanup path after the handshake is aborted. This allows an unauthenticated attacker to flood a public route, causing unbounded memory growth and service unavailability.

frp versions 0.53.0 through 0.70.1 have a vulnerability in the optional SSH Tunnel Gateway in pkg/ssh/server.go, where parsing an SSH exec channel request adds 4 to an attacker-controlled length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeating the bounds check and causing a panic in TunnelServer.handleNewChannel. When no authorized-keys file is configured, an unauthenticated peer can reach this phase before the frp token is checked, and a single five-byte request terminates the frps process and drops every active tunnel. The issue is fixed in version 0.70.1.

Backstage before version 0.29.2 has a vulnerability in the experimental dynamic client registration and client ID metadata document features in @backstage/plugin-auth-backend. Full-string glob matching can be bypassed, allowing an attacker-controlled redirect URI with a trusted hostname suffix in its path to pass the allowlist and receive an OAuth authorization code after a victim completes the flow. These features are experimental and disabled by default.

Mongoose before versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2 has a prototype pollution vulnerability when passing a user-controlled update with a __proto__.x dotted path under $set. The casting process can set properties on Object.prototype, affecting application integrity and availability.

Hub prior to version 0.2.16 has a vulnerability where every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionEventListeners, which calls requestClientId and sends a get-client-id action, pushing a request into RPC.requests. The RPC.waitForReply function starts a setInterval polling loop every 10 milliseconds that is cleared only after a matching reply; if the client remains silent and closes, the timer and pending request stay allocated. Repeated connections cause unbounded timers and heap entries, exhausting CPU and memory and making the server unavailable. The issue is fixed in version 0.2.16.

Rainbond through version 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticated attackers to access unauthorized enterprise resources by substituting another enterprise's tenant name in URL paths. Attackers can use any valid API token to bypass enterprise ID verification and access or modify another enterprise's services, plugins, environment variables, and certificates.

CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed with the hardcoded secret value, specifying ssh_user=root, to authenticate to the terminal service without any valid credentials and receive a root shell.

CyberPanel before version 3.0.0 has a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can access credential files, SSL/SSH private keys, and JWT secret files.

The 'podman quadlet install --replace' command opens the existing Quadlet file without O_TRUNC, which on filesystems without reflink support (e.g., default XFS on RHEL) leads to incomplete overwriting. If the new Quadlet is shorter than the original, old data remains at the end of the file, and the command completes without warning.

A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint.

This CVE candidate has been rejected. Reason: This candidate was issued in error. All references and descriptions have been removed to prevent accidental usage.

A vulnerability in the parse_read_std_char_desc() function in the Bluetooth host subsystem (subsys/bluetooth/host/gatt.c) allows a remote, unauthenticated device to hang the Bluetooth processing thread by sending an ATT response with a zero entry length (rsp->len = 0). The parsing loop does not validate the minimum value of rsp->len, leading to an infinite loop (CWE-835) and failure to terminate descriptor discovery.