CVE Vulnerability Catalog

There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution. By sending specially crafted packets to the PAPI UDP port (Aruba's access point management protocol), it is possible to gain access to the operating system with privileged user rights.

Envoy is an open source edge and service proxy that prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 had an issue with case sensitivity in HTTP/2 schemes. This could lead to the rejection of requests with mixed-case schemes or the bypassing of some requests in unencrypted connections.

A vulnerability in Envoy that causes the application to crash when the `origin` header is removed between `decodeHeaders` and `encodeHeaders`. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 contain a fix for this issue.

In Envoy, prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, gRPC access loggers using listener's global scope can cause a `use-after-free` crash when the listener is drained. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue.

In Envoy, prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malicious client can construct credentials with permanent validity in specific scenarios. This issue arises from rare situations where the HMAC payload can always be considered valid in the OAuth2 filter's check.

Tuleap prior to version 14.10.99.4 (Community Edition) and prior to versions 14.10-2 and 14.9-5 (Enterprise Edition) improperly handles content displayed in card fields, which may allow a malicious user to execute uncontrolled code.

Strapi, an open-source content management system, prior to version 4.10.8, allows leaking private fields when using the `t(number)` prefix. Changing the prefix in Knex queries can expose protected data such as admin passwords.

A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace.

A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel crash and denial of service.

The Apache Felix Healthcheck Webconsole Plugin version 2.0.2 and prior contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.

In JetBrains TeamCity versions before 2023.05.2, it was possible to perform an XSS attack via GitHub integration.

In JetBrains TeamCity versions before 2023.05.2, a ReDoS attack was possible via integration with issue trackers.

In JetBrains TeamCity before version 2023.05.2, a token with limited permissions could be used to gain full account access.

Java object deserialization issue in Jackrabbit webapp/standalone allows remote code execution by an attacker. This affects RMIVersions up to 2.20.10 (stable branch) and 2.21.17 (unstable branch) using the 'commons-beanutils' component.

Strapi, an open-source content management system, prior to version 4.10.8 allowed anyone to make content-type attributes public without realizing it. This vulnerability could lead to sensitive information being exposed as users might unknowingly remove the privateAttributes protection mechanism.

An unauthorized user could gain account access to IQ Wifi 6 versions prior to 2.0.2 by conducting a brute force authentication attack.

The MaxButtons plugin versions up to 9.5.3 contain a Cross-Site Scripting (XSS) vulnerability for users with contributor permissions and above. An attacker can exploit this flaw to inject malicious JavaScript code.

The Balkon plugin versions up to 1.3.2 contain a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.

The teachPress plugin versions up to 9.0.2 contain an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.

The wpxpo PostX – Gutenberg Post Grid Blocks plugin versions <= 2.9.9 contains an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious JavaScript code.