CVE Vulnerability Catalog

The dd-trace-py (Python) library for Datadog does not enforce limits on the number or size of items in W3C baggage headers during extraction. A remote, unauthenticated attacker can send a request with an arbitrarily large number of key-value pairs or a single very large value, causing unbounded CPU and memory consumption.

Vulnerability in rust-openssl from 0.10.50 to 0.10.80. The `CipherCtxRef::cipher_update_inplace` function incorrectly sizes output buffers for AES key-wrap-with-padding ciphers (`EVP_aes_{128,192,256}_wrap_pad`), causing up to 7 bytes of out-of-bounds write and heap corruption when input length is not a multiple of 8.

Netty before versions 4.1.136.Final and 4.2.16.Final has a vulnerability in STOMP frame decoding where StompSubframeDecoder does not limit the total number of headers or their cumulative size. An attacker can send many short headers, causing JVM memory exhaustion and denial of service.

IBM Langflow OSS versions 1.0.0 through 1.10.1 allow an authenticated attacker to exploit the SaveToFile component to read and modify another user's uploaded files by specifying absolute paths to victim storage locations. In append mode, the attacker reads victim file contents, appends own data, and uploads a copy to their namespace. In overwrite mode, they can replace victim file contents with arbitrary data.

IBM Langflow OSS versions 1.0.0 through 1.10.0 allow authenticated users to override component parameters at runtime via the API. A critical security flaw exists in the parameter filtering mechanism within the `apply_tweaks()` function.

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a vulnerability that allows an authenticated attacker to read arbitrary files, including the JWT signing key, and then forge authentication tokens for any user.

Vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0 allows remote code execution due to incomplete validation of MCP server configuration files.

IBM Langflow OSS versions 1.0.0 through 1.10.0 (including 1.9.0) contain a server-side request forgery (SSRF) vulnerability. The issue stems from an insecure default configuration and incomplete enforcement of the SSRF protection mechanism.

Vulnerability in IBM Langflow OSS (versions 1.0.0-1.10.0) allows an authenticated attacker to create a malicious flow that writes arbitrary files to the system via a crafted Content-Disposition header.

websocket-driver before version 0.8.1 is vulnerable to an attack where sending an HTTP request with an endless list of headers causes unbounded memory consumption in the receiving process.

In the websocket-driver library before version 0.8.1, the length header in the WebSocket protocol allows encoding an arbitrarily large integer as bytes with the high bit set. A server or client can send an indefinite sequence of 0x80 or higher bytes that are parsed into an ever-growing Ruby integer.

SSRF vulnerability in Xenforo 2.3.8 allows an attacker with admin privileges or RSS feed management to scan internal services and expose the server's original IP address.

The systeminformation library for Node.js before version 5.31.7 is vulnerable to OS command injection via the networkInterfaces() function on Linux. The issue stems from improper handling of the source directive in network configuration files, allowing arbitrary command execution.

Vulnerability in Skipper (HTTP router and reverse proxy) before version 0.26.10 allows bypassing request body inspection for HTTP/1.1 Transfer-Encoding: chunked and HTTP/2 requests without content-length header via OpenPolicyAgent integration. Attacker can send malicious data that is not inspected but reaches the upstream service.

Vulnerability in oras-go library (versions prior to 2.6.2) allows an attacker to use hard links to read or modify files outside the extraction directory, such as .env, .git/config, .aws/credentials, and ~/.ssh/config.

Vulnerability in the oras-go Go library for managing OCI artifacts. During monolithic blob upload, the client follows a registry-controlled Location header and reuses the Authorization header, allowing a malicious registry to redirect and steal credentials.

Vulnerability in the joserfc Python library before version 1.6.8 allows an attacker to forge HMAC tokens when the verification key is an empty string or None. The library does not reject zero-length keys, allowing signature verification bypass.

Information disclosure vulnerability in SimpleSAMLphp before 1.18.6 and in versions 2.x before 2.4.7 and 2.5.2. An attacker can exploit missing InResponseTo validation in signed assertions to bind a response from one trusted IdP to SP state created for another IdP, bypassing routing mechanisms.

Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Vulnerability in Wire library (gRPC/protobuf) for Android, Kotlin, Swift, and Java. In versions prior to 6.3.0 and 7.0.0-alpha03, skipGroup() methods do not validate that LENGTH_DELIMITED field length is non-negative, potentially causing ArrayIndexOutOfBoundsException and crashing services decoding untrusted data.