CVE Vulnerability Catalog

A vulnerability in Calico's Application Layer Policy (disabled by default) fails to perform URL path normalization, allowing attackers to bypass Prefix path rules using path-traversal segments, encoded slashes, or repeated slashes, enabling access to restricted HTTP endpoints.

A vulnerability in OpenCost before version 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing unauthenticated attackers to modify GCP service account keys via POST /serviceKey.

A vulnerability in Julep involves an insecure direct object reference (IDOR) in the get_execution_details endpoint, allowing authenticated tenants to read another tenant's execution data by supplying arbitrary execution_id values.

An SSRF vulnerability in Swarms through version 6.8.1 (fixed in commit 8b0fc9e) lies in the _is_safe_url function that fails to validate hostnames through DNS resolution, allowing attackers to bypass the blocklist by supplying image or audio URLs that resolve to private, loopback, or metadata addresses.

A vulnerability in MaxKey through version 4.1.12 (fixed in commit ddbb72f) involves insufficient redirect URI validation in DefaultRedirectResolver.hostMatches(), allowing remote attackers to hijack OAuth 2.0 authorization codes by supplying a crafted redirect_uri whose hostname suffix matches a registered URI without proper dot-boundary anchoring.

The Boruta library in Elixir has an improper isolation vulnerability allowing unauthenticated attackers to register OpenID Connect clients with administrative privileges. The lack of an allowlist lets attackers set sensitive attributes like grant types, scopes, PKCE enforcement, and token lifetimes.

A vulnerability in Calico's optional debug server (pprof), when enabled, listens on 0.0.0.0 without authentication. Any pod with network access can read the process heap, goroutine stacks (including function arguments), and command-line arguments, potentially exposing sensitive data.

IBM Enterprise Build of Quarkus REST has a vulnerability due to unbounded accumulation of multipart MIME part-header bytes, potentially leading to resource exhaustion.

IBM WebSphere Application Server Liberty is vulnerable to cross-site request forgery (CSRF), which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled.

IBM App Connect Enterprise has a vulnerability allowing a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters.

IBM App Connect Enterprise is vulnerable to a path traversal attack, allowing a remote attacker to read arbitrary files on the server.

IBM App Connect Enterprise stores potentially sensitive information in log files that could be read by a local user.

IBM Aspera Desktop App allows arbitrary code execution by loading DLL files at start-up.

IBM WebSphere Application Server Liberty is vulnerable to a denial of service (DoS) attack via a specially crafted request that causes excessive memory consumption.

Serendipity before version 2.6.1 has an authentication context confusion vulnerability where password validation and session loading operate independently. An authenticated Editor can create a username collision with an Administrator account and obtain administrative privileges by logging in with their own password while the session loads the Administrator's account data.

A vulnerability in the Date::Manip module for Perl (versions through 6.99) causes CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time when processing a long whitespace string.

A vulnerability in the Date::Manip module for Perl (versions through 6.99) returns corrupted dates when non-ASCII decimal digits are present in the input string, as they pass numeric range checks.

Softtr Information Technology Trade Ltd. Co. E-Commerce Pack before version 5.03.01.49 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of an authenticated user.

e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler. An attacker with database write access can store a crafted payload in the user_prefs column, which upon materialization of user preferences is passed to eval(), leading to automatic execution of arbitrary PHP code.

The SSH service on BSH ELP modules contains a vulnerability due to an insecure default configuration. A non-revocable SSH public key is included in the firmware's authorized_keys file for root. An attacker with the corresponding private key can bypass authentication and gain root-level access.