CVE Vulnerability Catalog

A vulnerability in Symfony allows an unauthenticated attacker, via a failed login request with a _failure_path parameter, to dispatch a subrequest to protected GET routes while bypassing firewall listeners. This occurs when failure_forward: true is enabled.

A Path Traversal vulnerability in Animate could lead to arbitrary code execution in the context of the current user. An attacker can exploit this to access sensitive files or directories outside intended restrictions. Exploitation requires user interaction, as a victim must open a malicious file.

An Incorrect Authorization vulnerability in Animate could allow arbitrary code execution in the context of the current user. Exploitation does not require user interaction but depends on conditions beyond the attacker's control. The scope of the vulnerability has changed.

An Incorrect Authorization vulnerability in Animate could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction (opening a malicious file) and depends on conditions beyond the attacker's control. The scope has changed.

Animate is affected by an OS Command Injection vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction to open a malicious file. The scope has changed.

Animate is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, as a victim must open a malicious file. The scope has changed.

Animate is affected by an OS Command Injection vulnerability that could allow arbitrary code execution in the context of the current user. Exploitation requires user interaction to open a malicious file. The scope has changed.

Adobe Experience Manager is affected by a Path Traversal vulnerability that allows unauthorized file system read outside the intended scope. An attacker can exploit this to access sensitive files and directories without user interaction.

Adobe Experience Manager is affected by a Missing Authentication for Critical Function vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation does not require user interaction and the scope is changed.

A vulnerability in the @grpc/grpc-js library allows an attacker to send an invalid compressed message, causing a crash of the client or server process. The issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

A vulnerability in the @grpc/grpc-js library allows remote crash of the server by sending an invalid HTTP/2 stream initiation request. Affected versions are prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

Adobe Commerce is affected by an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This allows a high-privileged attacker to execute arbitrary code in the context of the current user.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could exploit this to bypass security measures and gain unauthorized read and limited write access, causing limited disruption to availability. Exploitation does not require user interaction.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could exploit this to bypass security measures and gain unauthorized read and limited write access. Exploitation does not require user interaction.

Puma versions 5.5.0 through 7.2.1 and 8.0.2 are vulnerable to source IP spoofing. When proxy_protocol: :v1 is enabled and persistent connections are used, Puma incorrectly re-parses PROXY headers after each keep-alive request, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR.

A vulnerability in Puma (versions 5.5.0 through 7.2.1 and 8.0.2) with PROXY protocol v1 support enabled allows an attacker to continuously send bytes without CRLF, causing unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer.

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause missing release of memory after effective lifetime. A successful exploit of this vulnerability might lead to denial of service.

NVIDIA Triton Inference Server for Linux contains a vulnerability that allows an attacker to trigger an uncaught exception. Successful exploitation of this vulnerability could lead to denial of service.