CVE Vulnerability Catalog

AWS security-agent-mcp-server before version 0.2.0 has an argument injection vulnerability in the diff scan operation, which could allow an attacker to create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory via a crafted reference value.

Tapo C120 v1 and C200 v5 cameras do not enforce authentication for HTTPS onboarding connect actions after initial setup. An unauthenticated adjacent attacker can submit unauthorized wireless configuration parameters, causing the camera to attempt connection to a different network.

djehuty prior to version 26.3.2 contains a SPARQL injection vulnerability in search/listing queries through three parameters. An unauthenticated attacker can execute read queries, allowing cross-graph data exfiltration (e.g., private data) and denial-of-service via expensive or malformed queries.

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. An attacker who can have a Smile document parsed may embed a property name of unbounded length, causing memory exhaustion and denial of service. This issue also affects the CBOR parser and is tracked in advisory GHSA-3v8f-v6vx-fmrm.

The CBOR parser in FasterXML jackson-dataformats-binary does not enforce the maxNameLength limit for JSON object property names, allowing processing of names of unbounded length. An attacker can submit a CBOR document with an extremely long property name, leading to memory exhaustion and denial of service. The vulnerability is specific to binary formats and does not affect the standard JSON parser in jackson-core.

An improper privilege management vulnerability (CWE-269) exists in the command shell of Wind River VxWorks 7 when configured to enforce per-user command privileges. Under certain shell operations, a command may be evaluated without the normally applied privilege check, allowing an authenticated user with limited privileges to execute commands they are not authorized to run. The issue affects all versions of VxWorks 7 prior to 26.09 and has been fixed in 26.09.

Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service that becomes accessible after a reboot, and submit crafted input to execute arbitrary commands within the device management process.

TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary operating system commands.

The Zod schema-validation library contains an uncontrolled resource consumption vulnerability: an attacker can exhaust memory by submitting a large array, set, or map to an application using a container schema without an explicit size constraint. The $ZodArray parse logic (and equivalent set and map paths) accumulates every validation issue for each failing element with no cap, causing one issue object per element and an out-of-memory crash. The fix in 4.6.6 only addresses schemas with an explicit upper bound; the unbounded default case remains unmitigated.

A flaw in Foreman allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the server. By manipulating the permitted methods list in the template rendering engine, an attacker can bypass the safemode sandbox and execute unauthorized commands.

Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.

djehuty, a research data repository system, prior to version 26.3.2, allows an authenticated depositor to inject arbitrary SPARQL into a state-modifying (DELETE/INSERT) query by supplying a crafted session name, letting them write and delete arbitrary triples anywhere in the RDF store. This compromises the integrity of the whole repository's metadata.

A use after free exists in mod_auth_digest in Apache HTTP Server before 2.4.69 on all platforms. An unauthenticated remote client can cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.

Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0.

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.68.

A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails.

Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default.

In mod_proxy_ftp of Apache HTTP Server through 2.4.68, improper validation of the PASV reply address allows an untrusted FTP server, in forward proxy configurations, to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.

In Apache HTTP Server on Windows, processing paths with 8.3 names that may grow when expanded leads to an out-of-bounds write vulnerability. Affects versions from 2.4.0 through 2.4.68.

An out-of-bounds write vulnerability in Apache HTTP Server's mod_proxy_html occurs when processing crafted HTTP response bodies. The issue affects version 2.4.68.