CVE Vulnerability Catalog

In Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124, a stack-based buffer overflow vulnerability exists in the sub_40BB50 function of the /proc/webmon_recent_domains file. The attack can be performed remotely. This project is superseded by FreshTomato.

A flaw in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124 in the setup_conntrack function of /sbin/rc allows out-of-bounds write via the ct_tcp_timeout argument. The attack can be performed remotely.

Directory traversal vulnerability in VMware Avi Load Balancer. An authenticated network user can perform directory traversal attacks.

Vulnerability in VMware Avi Load Balancer allowing privilege escalation. A malicious authenticated user with network access can execute remote code.

VMware Avi Load Balancer contains a remote code execution vulnerability. An authenticated attacker with network access can inject and execute code.

Vulnerability in VMware Avi Load Balancer allows a local user to escalate privileges to root. An attacker with local access can exploit this flaw to run code with administrator privileges.

VMware Avi Load Balancer contains a remote code execution vulnerability. An unauthenticated attacker with network access can access the Avi Control plane and execute code remotely.

VMware Avi Load Balancer has an authorization bypass vulnerability. An attacker on the network can access a limited subset of the Avi Control Plane without proper authorization. Multiple versions affected, patches available.

A server-side request forgery (SSRF) vulnerability has been identified in Sipeed PicoClaw up to version 0.2.9. The issue affects the web_fetch function in the file pkg/tools/integration/web.go. Remote exploitation is possible, and the exploit is publicly available.

JLine, a Java library for console input, contains a vulnerability in the Telnet server remote-telnet module. The TelnetIO.handleNAWS() function does not limit terminal dimensions received from the client, allowing an unauthenticated attacker to repeatedly set large values (e.g., 65535x65535), causing intensive rendering calculations and CPU exhaustion (DoS).

JLine is a Java library for console handling. Prior to versions 3.30.14, 4.0.16, and 4.2.1, the Telnet module does not limit the number of environment variables a client can inject. An unauthenticated attacker can send many unique variable pairs, causing JVM heap memory exhaustion and an OutOfMemoryError.

Vulnerability in Windows RDP allows an unauthorized attacker to disclose private personal information over a network. The attacker can intercept data transmitted during an RDP session.

HAPI FHIR prior to versions 6.9.9 and 6.9.4.2 accepts arbitrary FHIRPath expressions without input validation. The functions matches(), matchesFull(), and replaceMatches() pass user-controlled regular expressions to Pattern.compile() and String.replaceAll() through an incomplete timeout utility. An attacker can send a resource with a malicious regex pattern causing catastrophic backtracking, exhausting CPU resources and causing denial of service.

XSS vulnerability in the view_component framework for Ruby on Rails versions 4.0.0-4.12.0. The around_render method can return unsanitized HTML strings that bypass escaping, creating XSS risk, especially when using ViewComponent::Collection.

The websocket-driver library before version 0.7.5 incorrectly handles the frame length in the WebSocket protocol. By sending an indefinite sequence of bytes with the high bit set, an attacker can cause the server to parse these bytes as an ever-growing integer, leading to precision loss and incorrect payload parsing.

SSRF vulnerability in the Ruby css_parser library versions 2.2.0 through 3.0.0. The read_remote_file method makes HTTP/HTTPS requests to any host without filtering, and redirects can lead to local file disclosure via file:// URIs.

Buffer overflow vulnerability in libjxl library version 0.11.2 and earlier in the DecodeImageAPNG function. A local attacker can exploit this to obtain sensitive information.

Vulnerability in MCMS version 6.1.1 allows a remote attacker to obtain sensitive information via the source parameter.

The dd-trace-go (Go) library for Datadog does not enforce limits on the number or size of items in W3C baggage headers during extraction. A remote, unauthenticated attacker can send a request with an arbitrarily large number of key-value pairs or a single very large value, causing unbounded CPU and memory consumption.

The dd-trace (Node.js) client for Datadog does not enforce limits on the number or size of items in W3C baggage headers during extraction. A remote, unauthenticated attacker can send a request with an arbitrarily large number of key-value pairs or a single very large value, causing unbounded CPU and memory consumption.