CVE Vulnerability Catalog

In Vector from 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send a minimal frame declaring a multi-gigabyte payload, causing an excessive allocation that can abort Vector or invoke the host OOM killer. This issue is fixed in version 0.57.0.

Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users. An authenticated viewer can request the streams, config, log, and stack subpaths to obtain internal addresses, configuration paths, application logs, goroutine stack data, and RTSP stream URLs that may contain camera credentials. This issue is fixed in version 0.18.0.

Frigate is an open source network video recorder. Prior to 0.17.2, the WebSocket handler in frigate/comms/ws.py forwards attacker-selected message topics to the dispatcher without checking the authenticated user's role because the nginx authentication subrequest does not provide role-aware authorization to the handler. Any authenticated viewer can send admin-only topics such as restart, notifications/set, and camera detection, recording, snapshot, audio, motion, and enablement settings, causing service restarts or disabling security monitoring functions. This issue is fixed in version 0.17.2.

Vulnerability in Apache Calcite Avatica allows unsafe reflection, where externally-controlled input can lead to initialization of arbitrary classes. This may result in execution of static initializer blocks in classes present in the classpath. Affects versions before 1.29.0.

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header in src/dashboardGuard.js when isLocalRequest decides whether canAccessPublicLlmApi may skip API-key validation for /api/v1/* routes. A remote unauthenticated attacker can set X-9r-Real-Ip to 127.0.0.1 and be classified as a local client, including on the verified GET /api/v1/models route. This issue is fixed in version 0.5.6.

A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function file_put_contents of the file codeEditor.php of the component Save Handler. The manipulation of the argument filename/content leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

In FasterXML jackson-core, the NumberInput.looksLikeValidNumber() method uses regular expressions to validate stringified numbers. Due to overlapping quantifiers in the PATTERN_FLOAT regex, matching cost grows quadratically with input length. An attacker can supply a long JSON string that is coerced to a numeric type, exhausting the server's request-handling threads.

A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can modify the inbound proxy configurations of other users, including remark, port, protocol, settings, enabled state, expiry time and traffic quota, by submitting a request referencing the target resource identifier. The update path fails to verify that the target resource belongs to the requesting session user, allowing unauthorized cross-user modification of data.

NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controlled .pkl file via pickle.load() without validation. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure.

NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted model_config.yaml can inject unsafe parameters. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure.

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.

SQL injection vulnerability in NVIDIA Infrastructure Controller for Linux. An attacker could exploit it to achieve code execution, data tampering, denial of service, and information disclosure.

Improper authentication in NVIDIA Infrastructure Controller for Linux. Could lead to privilege escalation, information disclosure, and data tampering.

Improper certificate validation in NVIDIA Infrastructure Controller for Linux. Could lead to information disclosure, data tampering, and denial of service.

Missing authentication for a critical function in NVIDIA Infrastructure Controller for Linux. Could lead to data tampering, denial of service, and information disclosure.

Code injection vulnerability in NVIDIA NeMo Speech. Malicious input could lead to code execution, information disclosure, and data tampering.

Remote code execution vulnerability in the speech data explorer component of NVIDIA NeMo Speech. Malicious data could allow code execution, privilege escalation, information disclosure, and data tampering.

Remote code execution vulnerability in NVIDIA NeMo Speech. Malicious data could allow code execution, information disclosure, and data tampering.

Potential vulnerability in HP Support Assistant prior to version 9.55.10.0. Insufficient access controls could allow a local attacker to escalate privileges.

Flaw in php-file-manager-with-code-editor up to 3.0. Manipulating the files argument in move_uploaded_file in filemanager.php leads to unrestricted upload. Attack can be executed remotely.