CVE Vulnerability Catalog

WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin() strips leading C0 control characters and spaces. An attacker-controlled value such as a space followed by a protocol-relative or absolute URL can therefore bypass SCHEME_RE and startswith("//") checks and be normalized to an off-host redirect. Request.relative_url() and webob.exc._HTTPMove subclasses, including HTTPFound, are also affected because they use the same unsafe URL joining behavior or bypass the earlier normalization path. An unauthenticated attacker who can influence an application's redirect target can send users to an attacker-controlled host for phishing or OAuth and SSO token theft, but exploitation requires the user to follow the redirect. This issue is fixed in version 1.8.11.

NanaZip from version 1.0.88.0 until stable 6.0.1698.0 and preview 6.5.1742.0 has a vulnerability in the Lz4Decode function that rejects only a zero return from LZ4_decompress_safe, while malformed input produces a negative error value. The negative int is converted to unsigned SizeT, leading to out-of-bounds read and potential data leak or crash.

LangBot version 4.10.7 and earlier has a vulnerability that allows any authenticated user to add or change an STDIO MCP server configuration without an adequate authorization boundary. An attacker can configure commands and arguments that are executed as a subprocess on the LangBot server, enabling arbitrary command execution with LangBot service privileges.

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to 1.715.0, a resource-scoped API token could read script contents outside its allowed path scope through GET /api/w/{workspace}/scripts/list_search. The route-level scope middleware validated the token domain and action but did not enforce the resource/path segment, and the list_search_scripts handler had no additional check_scopes call or per-row filtering before returning script path and content fields. A token such as scripts:read:f/allowed/* could therefore receive source code for unrelated paths in the same workspace, potentially disclosing internal automation logic, integration details, business logic, inline configuration, or hardcoded secrets and credentials. Exploitation required possession of a valid scoped API token for the workspace but did not require administrator privileges. This issue is fixed in version 1.715.0.

deepmerge-ts prior to 8.0.0 has a vulnerability in the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs that do not track visited objects when recursively merging. When two input values contain self-references at the same property path, the merge logic repeatedly revisits the same pair until Node.js raises RangeError: Maximum call stack size exceeded, causing process crash.

This vulnerability allows a remote attacker to execute arbitrary code in GIMP when parsing APNG files. The issue is due to lack of proper validation of user-supplied data, leading to an integer overflow before buffer allocation. User interaction is required, such as opening a malicious file.

This vulnerability allows a remote attacker to execute arbitrary code in GIMP when parsing TIF files. The issue is due to lack of proper validation of user-supplied data, leading to an integer overflow before buffer allocation. User interaction is required, such as opening a malicious file.

This vulnerability allows a remote attacker to execute arbitrary code in GIMP when parsing TIF files. The issue is due to lack of proper validation of the length of user-supplied data before copying it to a heap-based buffer, leading to a heap-based buffer overflow. User interaction is required, such as opening a malicious file.

This vulnerability allows a remote attacker to execute arbitrary code in GIMP when parsing SGI files. The issue is due to lack of proper validation of user-supplied data, leading to an integer overflow before writing to memory. User interaction is required, such as opening a malicious file.

This vulnerability allows a remote attacker to execute arbitrary code in GIMP when parsing TIF files. The issue is due to lack of proper validation of user-supplied data, leading to an integer overflow before buffer allocation. User interaction is required, such as opening a malicious file.

This vulnerability allows a remote attacker to execute arbitrary code in GIMP when parsing TIF files. The issue is due to lack of proper validation of user-supplied data, leading to an integer overflow before buffer allocation. User interaction is required, such as opening a malicious file.

This vulnerability allows a remote attacker to execute arbitrary code in GIMP when parsing TIF files. The issue is due to lack of proper validation of the length of user-supplied data before copying it to a stack-based buffer, leading to a stack-based buffer overflow. User interaction is required, such as opening a malicious file.

This vulnerability allows a remote attacker to execute arbitrary code in GIMP when parsing TIF files. The issue is due to lack of proper validation of the length of user-supplied data before copying it to a heap-based buffer, leading to a heap-based buffer overflow. User interaction is required, such as opening a malicious file.

This vulnerability allows a remote attacker to execute arbitrary code in GIMP when parsing PSD files. The issue is due to lack of proper validation of user-supplied data, leading to an integer overflow before buffer allocation. User interaction is required, such as opening a malicious file.

This vulnerability allows a remote attacker to execute arbitrary code in GIMP when parsing HDR files. The issue is due to lack of proper validation of user-supplied data, leading to an integer overflow before buffer allocation. User interaction is required, such as opening a malicious file.

Use-After-Free vulnerability in GStreamer rtpsbcdepay allows remote code execution. Lack of validating object existence before operations leads to use-after-free. An attacker can leverage this to execute code in the context of the current process.

Heap-based buffer overflow in GStreamer PNG file parsing allows remote code execution. Lack of proper length validation before copying data to heap buffer leads to overflow. User interaction is required, such as visiting a malicious page or opening a malicious file.

Stack-based buffer overflow in GStreamer OGG file parsing allows remote code execution. Lack of proper length validation before copying data to stack buffer leads to overflow. User interaction is required, such as visiting a malicious page or opening a malicious file.

Heap-based buffer overflow in GStreamer MRF file parsing allows remote code execution. Lack of proper length validation before copying data to heap buffer leads to overflow. User interaction is required, such as visiting a malicious page or opening a malicious file.

Out-of-bounds write in GStreamer MRF file parsing allows remote code execution. Lack of proper validation of user-supplied data leads to write past the end of an allocated buffer. User interaction is required, such as visiting a malicious page or opening a malicious file.