CVE Vulnerability Catalog

Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released when an internal aggregation stage is combined with a batch size of 0. Query results returned to the client may contain unrelated data from the server process, and the server process may also terminate unexpectedly.

This CVE candidate has been rejected by Red Hat Product Security because it is not a security vulnerability. BusyBox internal TLS is intentionally minimal and documents in FEATURE_WGET_HTTPS that it does not verify peer identity or provide full TLS security; missing Finished verify_data checking is consistent with that documented design and does not cross a separate security boundary warranting a CVE.

In ESP-IDF BlueDroid, L2CAP configuration-option processing in l2c_main.c and l2c_utils.c does not consistently validate option lengths against the remaining received packet bytes. A remote unauthenticated BR/EDR peer within radio range can send a malformed L2CAP configuration request causing an out-of-bounds read, and under some runtime conditions limited adjacent Bluetooth stack memory can be included in an outbound L2CAP Configuration Response.

The vulnerability in Xen concerns logic introduced for XSA-308, which does not handle a certain combination of VMX VMEntry state when #DB is intercepted, single stepping is active, and blocked by STI/MovSS. With branch tracing enabled, the prior adjustment still causes a VMEntry failure, fatal to the guest.

The vulnerability in Xen concerns issues with grant table operations, where v2 -> v1 -> v2 changes can lead to changes in the addresses of status pages. Previously calculated pointers into the status array may become stale, potentially leading to incorrect behavior.

The vulnerability in Xen concerns the XPTI (Xen Page Table Isolation) mechanism, which copies PV guest page table entries from guest-chosen root page tables to the Xen-chosen one. PV guests may have a directmap that does not cover all memory, especially when memory extends beyond the 5 TiB (or 3.5 TiB with CONFIG_BIGMEM=y) address boundary.

The vulnerability in Xen concerns the workaround for XSA-433 (Zenbleed), which was reworked but introduced an inverted conditional, causing the workaround to not be applied when needed and vice versa.

The vulnerability in Xenstore concerns live update, where the state record for a Xenstore watch with specified watch depth is written with two bytes missing. This results in an inconsistent state when reading the state back in the new Xenstore, causing a crash of Xenstore or wrong Xenstore data.

The vulnerability in the SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) version V1.0.3 allows a remote attacker to execute arbitrary code.

In KeePassXC prior to 2.8.0-beta1, KeePass1 / KDB legacy import retains raw Entry pointers in m_entryUuids after deleting metastream entries. When a crafted .kdb file contains an earlier metastream entry followed by a KPX_CUSTOM_ICONS_4 metastream referencing the earlier UUID, parseCustomIcons4() calls Entry::setIcon through the stale pointer, causing a heap use-after-free with a controlled write and a reliable process crash.

FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an arbitrary Git repository URL through admin/updater-handler.php and trigger perform_update, which passes the URL to update.sh. The updater clones the repository and replaces the live plugins/, admin/, and includes/ directories without verifying the repository's identity, signatures, or contents. Because router.php permits existing PHP files under plugins to be executed by the PHP development server, attacker-supplied update content can execute arbitrary PHP with the web server process's privileges and persist as a backdoor.

The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact, and the secret-bearing workflow_run job in .github/workflows/build-pr.yml checks out that commit before running pip install -r requirements.txt. A fork pull request can therefore supply attacker-authored setup.py or PEP 517 build hooks whose installation code executes in the privileged base-repository workflow with CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY, and a write-capable GITHUB_TOKEN, allowing secret disclosure and follow-on compromise.

A vulnerability in Heym before version 0.0.40 allows an authenticated user who can create or edit a workflow with a custom Python tool to bypass the blacklist-based sandbox. Standard Python libraries expose system functions that pass validation, and the tool is executed via exec(), enabling command execution and file operations as the backend application user. The issue is fixed in version 0.0.40.

In ConnectBot SSH Client Library prior to 0.3.1, the SSH protocol parser trusts attacker-controlled inner byte lengths and element counts without verifying that they fit in the containing packet. A malicious or compromised SSH server can return a small malformed packet whose oversized declarations cause excessive allocation or repeated parsing, leading to an uncaught OutOfMemoryError and termination of the application process.

In ConnectBot SSH Client Library prior to 0.3.1, DerReader.readLength() accepts excessive long-form DER length octets, accumulates them into an Int, and primitive readers allocate arrays without checking the declared size against the remaining input. Loading an attacker-provided private-key file through SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), or SshSigning.getPublicKey() can trigger integer wraparound, excessive allocation, or an uncaught OutOfMemoryError.

OAuthLib versions 3.0.0 through 4.0.0 compare attacker-supplied code_verifier values with stored challenges using ordinary string equality in PKCE checks, potentially leaking common-prefix timing information. This could allow recovery of the code_verifier, unauthorized access-token acquisition, and account takeover, though practical exploitation requires an intercepted single-use authorization code and many measurements. The issue is fixed in version 4.0.0.

OAuthLib versions 0.6.1 through 4.0.0, when enable_jsonp=True, reflect an unvalidated callback request parameter into success and error response bodies in RevocationEndpoint. This allows execution of attacker-controlled JavaScript in the context of an application that loads the response as trusted JSONP, if the attacker can influence the callback. The feature is disabled by default and only affects deployments that explicitly enable JSONP. Fixed in version 4.0.0.

A vulnerability in slackero phpwcms up to version 1.9.49/1.12.3 involves unrestricted file upload in the Extension Check component, in the file include/inc_front/content/cnt23.article.inc.php, via manipulation of the POST_name argument. The attack can be performed remotely. Fixes are available in versions 1.9.50 and 1.12.4.

A vulnerability in SourceCodester Simple Cafe Billing System 1.0 affects the Action::save_user function in the file admin_class.php, in the User Management component. Manipulation of the Type argument leads to improper authorization. The attack can be performed remotely, and the exploit has been publicly disclosed.

In HBAI-Ltd Toonflow-app up to 1.1.8, an unknown function of the exportData Endpoint component leads to information disclosure. The attack requires local access, and the exploit has been disclosed to the public. Upgrading to version 2.0.0 mitigates this issue. The vendor explains that the report targets version 1.1.8, while the current release 2.0.4 is the result of a substantial architectural refactor and the referenced code paths do not apply.