CVE Vulnerability Catalog

Vulnerability in Data::NDArray::Shared for Perl before version 0.02. The mmap backing file is created with mode 0666, resulting in 0644 (world-readable) under default umask 022. Missing O_EXCL and O_NOFOLLOW flags allow a local attacker to follow a symlink or replace the file before creation.

Vulnerability in Data::Graph::Shared for Perl before version 0.04 creates a world-readable mmap backing file and opens it without O_EXCL and O_NOFOLLOW flags. This allows a local attacker to read IPC data and exploit a race condition or symlink.

Vulnerability in Data::Deque::Shared for Perl before version 0.06 creates a world-readable mmap backing file and opens it without O_EXCL and O_NOFOLLOW flags. This allows a local attacker to read IPC data and exploit a race condition or symlink.

Vulnerability in SoupAuthManager that caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leading to credential leakage.

Concurrent Login vulnerability in HCL MyCloud increases the risk of unauthorized access, session hijacking, and account misuse.

HCL MyCloud is affected by the SSL/TLS LUCKY13 vulnerability. An attacker can decrypt sensitive information via a TLS/SSL padding oracle attack.

HCL MyCloud has a missing Cookie Attribute Path vulnerability. This increases the risk of unauthorized access to session data or authentication tokens.

HCL MyCloud is affected by using components with known vulnerabilities (IIS Server). This may allow attackers to exploit publicly disclosed weaknesses and compromise the system.

Vulnerability in HCL MyCloud exposes the license key in HTTP responses. Attackers can misuse this information to compromise application security.

HCL MyCloud exposes the server version, which may help attackers identify and exploit known vulnerabilities for the disclosed software versions.

HCL MyCloud was affected with a weak password policy, increasing the risk of account compromise through brute-force or credential-based attacks.

Missing X-Content-Type-Options header in HCL IEM allows attackers to perform SSL stripping or man-in-the-middle attacks and intercept sensitive data.

Missing Anti Clickjacking X-Frame-Options header in HCL IEM allows attackers to embed the application in malicious pages and induce unauthorized user actions.

A logic error in libssh's automatic certificate-based public key authentication causes libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.

HCL IEM does not enforce strict transport security (HSTS), allowing attackers to perform SSL stripping or man-in-the-middle attacks, compromising secure communications.

HCL IEM was affected with an information disclosure issue in the nginx server, which may enable attackers to identify outdated software versions and target known vulnerabilities or publicly available exploits.

A flaw in libssh: a malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.

In libssh, during server-side GSSAPI key exchange, a short Curve25519 public key is copied without proper length validation, causing an out-of-bounds heap read.

In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in nni_mqttv5_msg_decode_connect allows a malicious MQTT broker to crash any connecting NanoMQ MQTTv5 client (including bridge mode) with a single packet, causing remote denial of service via SIGSEGV. The issue occurs because the code uses variable 'prop' instead of 'will_prop' when iterating over CONNECT properties.

HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.