CVE Vulnerability Catalog

Gitea's container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed image manifests, without a `Content-Disposition` or restrictive content security policy. A user who can push container images can publish a blob containing HTML and JavaScript with a `text/html` media type. When a victim who is authenticated to the instance opens the blob URL in a browser, the script runs on the Gitea origin and can perform actions as the victim, such as creating API tokens.

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains this weakness in how it builds and serializes geometry values produced by scripted runtime fields. An authenticated user with read access to a single index can submit a request defining such a field with a script that produces a deeply nested structure, causing the affected node to terminate. The node does not recover automatically on all deployments and may require manual intervention.

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains this weakness in its search aggregation processing. An authenticated user with read access to a single index can submit a crafted request containing deeply nested aggregation definitions, triggering unbounded recursive execution that exhausts the server process's resources and causes the affected node to terminate. The node does not recover automatically and requires manual intervention.

Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges could cause the cluster to allocate an uncontrolled amount of memory when connector resources with an excessively large `description` field are created and subsequently accessed, exhausting available heap memory and crashing the affected node.

Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When Elastic Defend's Elastic Endpoint component processes a file name under certain system locale configurations (including Chinese, Japanese, and Korean locales) on Windows, an unhandled exception can occur during file-path handling. This causes the Elastic Endpoint process to crash and restart repeatedly, degrading or disabling Elastic Defend's real-time malware prevention and behavioral detection capabilities on the affected host for as long as the condition persists.

Incorrect authorization in Kibana can lead to disclosure of sensitive information. An authenticated user with limited Fleet privileges could access credential material restricted to Fleet administrators. Exploitation may allow theft of cryptographic keys and impersonation of trusted Fleet infrastructure components.

Elasticsearch does not limit total memory used when retrieving multiple index templates, despite per-resource limits. A user with manage_index_templates privilege can register many templates, and retrieving them together exhausts heap memory, causing node failure and denial of service.

Missing authorization in Kibana's Metrics Experience feature allows a user with only data-store-level read access to retrieve index-derived metric data through Kibana, despite lacking the corresponding Kibana feature privilege. A related API enforced authorization, but this internal API did not.

Uncontrolled recursion in Elasticsearch allows an authenticated low-privileged user to terminate an Elasticsearch node, resulting in denial of service. The vulnerability is related to excessive resource allocation.

Inefficient regular expression complexity in Elasticsearch's ES|QL CHUNK function can lead to denial of service via catastrophic backtracking. A user with read access to a text-based index can submit a crafted regex causing excessive CPU consumption and degrading query throughput for other tenants.

Incorrect authorization in Elasticsearch allows an authenticated user with privileges over a single resource to modify a data stream they are not authorized for. This can allow data injection or affect searchability, but does not enable reading the stream's contents.

Uncontrolled resource consumption in Elasticsearch allows a low-privileged user to crash a node with a crafted query causing uncontrolled memory growth. The condition can be triggered repeatedly, including via queries in shared resources, causing persistent cluster unavailability.

On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client can crash the portal service with a crafted HTTP request. The service restarts automatically, but a sustained low-rate attack can cause persistent denial of service. Remote code execution is not possible.

On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client can crash the portal service with a crafted HTTP request. This results in temporary denial of service until the service restarts automatically. Remote code execution is not possible.

Improper validation of selected CloudVision CUE API request parameters may allow an authenticated network user to perform SQL injection against the backend, impacting its availability.

An IDOR vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data.

Improper neutralization of LDAP authentication input may allow an unauthenticated network attacker, under high-complexity conditions, to inject queries against the configured directory service.

Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, redirects the user's browser to an arbitrary external site upon completion of the authentication process.

Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.

Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.