CVE Vulnerability Catalog

Not failing securely (failing open) vulnerability in ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not. This can lead to security-relevant modifications being bypassed.

Uncontrolled resource consumption vulnerability in ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it. The AsyncLimiter.await_at_least_one/1 function used a tight loop with Task.yield(task, 0), causing busy-spinning.

Improper validation of specified type of input vulnerability in ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that uses storage: :map_with_tag, bypassing that member's validation and any tag-based authorization. The dump_to_native/2 function did not force the configured tag, allowing a value with a tag naming a different member to be stored.

Vulnerability in the ash library involves improper input validation for attributes with doubly-nested arrays. Constraints on the outer array are not enforced, allowing invalid data to be accepted.

Vulnerability in the ash library discloses the stored value of a confirmed field to an attacker who fails the confirmation check. The atomic implementation of Confirm validation returns the stored field value in the error message.

Vulnerability in the ash library involves incorrect behavior order: validation before canonicalization. An attacker can store a case-insensitive string value that violates length or match constraints.

Vulnerability in the ash library allows an attacker to submit a non-finite decimal value (e.g., Infinity or NaN) that bypasses numeric bounds constraints or causes failures in later operations.

Vulnerability in the ash_typescript library allows an attacker who controls a path-parameter value to redirect a generated client's request, along with attached credentials, to an unintended route or external origin.

Vulnerability in Node.js HTTP client can cause request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from visible IncomingMessage headers while piping the original body to a reused backend connection.

Vulnerability in the popt library allows an attacker to provide specially crafted configuration content that, when loaded, can lead to a small memory corruption issue due to an error in how the poptConfigFileToString function reallocates memory for buffers.

Wallos prior to version 5.0.0 allows any authenticated user to store an arbitrary SMTP host (including private and cloud-metadata IP addresses) in their email notification settings, with no server-side SSRF validation. When the scheduled notification cron job runs, it passes the stored host directly to PHPMailer, causing the Wallos server to open an outbound TCP connection to the specified address. This gives a low-privileged attacker a reliable mechanism to probe internal network services from the server's perspective. This issue has been patched in version 5.0.0.

A flaw has been found in sdcb chats up to version 1.12.0. It affects the DownloadPublic function in FileController.cs (Signed File Download Endpoint). Missing authentication allows remote exploitation, but the attack complexity is high and exploitability is difficult. The exploit has been published.

A vulnerability in the I3C IBI subsystem of the Linux kernel (drivers/i3c/i3c_ibi_workq.c) stems from missing synchronization on the free-list of work nodes (sys_slist_t). Allocation and deallocation helpers are called from interrupt context (ISR) and the workqueue thread without locks, leading to a race condition. An attacker with physical access to the I3C bus can trigger a series of interrupts, causing list corruption, double allocation, or out-of-bounds writes.

A malicious virtual function can invoke certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory read.

In extension.vn 2FA Authenticator Extension 1.0.0.2 for Chrome, a weakness was found in the function chrome.runtime.onMessageExternal.addListener in the Background Service Worker. Manipulating the sender.id argument can lead to information disclosure. The attack requires local access.

HCL Connections is vulnerable to information disclosure, which could allow a user to obtain data they are not entitled to, caused by improper handling of request data.

In sambitraj Student Management System up to version 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5, a flaw was found in the Password Handler component in file aca.sql. Manipulating the Password argument leads to cleartext storage of sensitive information. The attack can be executed remotely.

In sambitraj Student-Management-System up to version 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5, a vulnerability was detected in the session_start function that leads to cookies without the 'httponly' flag. The attack may be launched remotely but is difficult to exploit.

A vulnerability was determined in valkey-io valkey 9.1.0. The function moduleTimerHandler in src/module.c of the Module Timer Subsystem causes double free. The attack can be initiated remotely, and the exploit is public. A patch is available.

A vulnerability has been found in IObit Unlocker 1.3.0.12. The function ZwTerminateProcess in the library IObitUnlocker.sys of the IRP_MJ_DEVICE_CONTROL Handler leads to improper privilege management. The attack requires local access. The vendor did not respond.