CVE Vulnerability Catalog

A flaw was found in Python's urllib.parse module where the urlparse method does not sanitize input, allowing characters like ' ' and ' ' in the URL path. This can lead to CRLF injection attacks.

An out-of-bounds write vulnerability was found in glibc before version 2.31 when handling signal trampolines on PowerPC. The backtrace function did not properly check array bounds when storing the frame address, leading to denial of service or potential code execution.

libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. It can detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte local stack buffer. Most modern malloc implementations detect this error and immediately abort.

Git is a fast, scalable, distributed revision control system. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload.

musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.

A divide-by-zero error was discovered in py-lmdb 0.97 in the mdb_env_open2 function when mdb_env_read_header obtains a zero value for a certain size field. This issue can be triggered by supplying a crafted data.mdb file.

A vulnerability in the DNS protocol, related to the Closest Encloser Proof aspect in RFC 5155 (when RFC 9276 guidance is skipped), allows remote attackers to cause a denial of service (DoS) by triggering excessive CPU consumption for SHA-1 computations. The attack involves sending DNSSEC responses in a random subdomain attack, known as the NSEC3 issue.

In nodemailer v9.0.0, the message-level `raw` option bypasses `disableFileAccess` and `disableUrlAccess` protections, enabling arbitrary file reads and full SSRF (Server-Side Request Forgery) in the sent message.

A vulnerability in Perl 5.30.0 through 5.38.0 allows a heap buffer overflow when compiling a crafted regular expression. An attacker can exploit this to cause a controlled buffer overflow.

Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served but not directly reachable, leading to code execution or source code disclosure.

The pip package before version 19.2 for Python is vulnerable to directory traversal when a URL is provided in an install command. An attacker can exploit a Content-Disposition header containing '../' in the filename to overwrite files, such as /root/.ssh/authorized_keys.

A vulnerability was found in systemd where a service using the DynamicUser property can create a SUID/SGID binary that remains executable with the transient service UID/GID even after the service terminates. A local attacker could exploit this to access resources owned by a potentially different UID/GID.

GNU libidn2 before version 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels, allowing domain impersonation in some circumstances. An attacker can create a malicious domain that matches a target domain except for certain characters.

Vulnerability in Libgcrypt before versions 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption due to missing exponent blinding, enabling a side-channel attack on mpi_powm. Additionally, the window size is not chosen appropriately, increasing information leakage risk.

A heap buffer overflow vulnerability was discovered in Perl. Affected versions include release branches 5.34, 5.36, 5.38, and 5.40, as well as development versions from 5.33.1 through 5.41.10. When non-ASCII bytes are present in the left-hand side of the `tr` operator, `S_do_trans_invmap` can overflow the buffer.

A use-after-free and double-free vulnerability was found in the c-ares library in the query-completion handling path. The flaw occurs when a query callback is invoked while the query is still linked in internal lookup structures. A remote attacker can exploit this via ares_getaddrinfo() over TCP by sending crafted data.

Vulnerability in CPAN 2.28 allows signature verification bypass. An attacker can supply unauthorized code that is treated as properly signed.

Wersje Mattermost 11.5.x do 11.5.1, 10.11.x do 10.11.13 oraz 11.4.x do 11.4.3 nie sanitizują wrażliwych pól konfiguracyjnych przed ich uwzględnieniem w generowaniu pakietów wsparcia. To umożliwia administratorowi systemu Mattermost lub każdej osobie mającej dostęp do pakietu wsparcia uzyskanie wrażliwych poświadczeń w postaci niezaszyfrowanej.