CVE Vulnerability Catalog

In versions up to 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does not validate the Domain attribute of a Set-Cookie header, violating RFC 6265. An attacker can inject a cookie for an arbitrary domain, which is stored and later transmitted to the targeted domain.

In Eclipse Vert.x up to versions 4.5.29 (4.x) and 5.1.4 (5.x), the DefaultRedirectHandler (vertx-core) forwards all request headers, including credential headers (Authorization, Cookie, Proxy-Authorization) and custom headers (e.g., X-API-Token), during cross-origin HTTP 30x redirects. No origin comparison (scheme, host, port) is performed before copying headers to the redirect target.

In Eclipse Jetty, the first HTTP/1.1 request with trailers causes the server to retain those trailers for subsequent requests on the same connection. Subsequent requests without trailers report the trailers from the first request, while requests with their own trailers report the union of the first and current request's trailers.

A vulnerability in Apache HTTP Server causes a buffer leak for requests with a body when reading the body may result in reading 0 bytes. This is particularly the case for 100-Continue requests, but also for any request with slow network connections.

An improper link resolution before file access vulnerability in the File Shredder module of Bitdefender Total Security and Internet Security on Windows allows a less-privileged local user to elevate privileges via a race condition using symbolic links.

A vulnerability in the suricata package for openSUSE Tumbleweed allows the suricata user to escalate privileges to root by following a UNIX symbolic link.

A vulnerability has been found in Online Job Portal 1.0, allowing unrestricted file upload via the txtFile argument in /JobSeekerInsert.php. The attack can be performed remotely, and a public exploit is available.

A security flaw was discovered in code-projects Online Job Portal up to version 1.0. An unknown function in the file /Admin/DeleteUser.php allows SQL injection. Remote exploitation is possible and the exploit has been publicly released.

A SQL Injection vulnerability was found in Online Job Portal 1.0 in the file /Admin/EditUser.php. An attacker can remotely manipulate the UserId argument, leading to SQL injection. The exploit is publicly available.

The Newsletters WordPress plugin before version 4.15 fails to prevent deserialization of untrusted input submitted via a public form. This allows unauthenticated attackers to inject a PHP object and, through a property-oriented gadget chain, write arbitrary files and execute code on the server.

The AI Engine WordPress plugin before version 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write attacker-controlled bytes to an arbitrary location on the server via path traversal.

A vulnerability in the SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a specially crafted archive file. Processing this file by the application's library triggers insecure deserialization, leading to remote code execution (RCE) on the system.

A vulnerability in SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript via crafted URLs. When a victim accesses such a URL, the script executes in the user's browser, enabling the attacker to access sensitive session information and modify non-sensitive data displayed in the client's browser.

SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lead to unauthorized access.

SAProuter on Microsoft Windows allows an unauthenticated attacker to load DLL files from an untrusted location, enabling arbitrary code execution. The attacker can hijack the DLL loading process and achieve remote code execution.

HedgeDoc before version 1.11.0 was vulnerable to a YAML alias bomb in note frontmatter. Unsafe parsing with js-yaml.load expanded YAML anchor aliases, creating huge object structures and excessive CPU consumption. An attack could block the Node.js event loop for about 235 seconds per request, causing denial of service (DoS).

A vulnerability in the Crypt::OpenSSL::X509 library for Perl before version 2.1.3 causes denial of service (DoS) via NULL pointer dereference. The X509V3_EXT_d2i(ext) function returns NULL when parsing an extension's DER value fails, and helper functions (basicC, ia5string, auth_att) do not check the result before dereferencing. Additionally, keyid_data dereferences akid->keyid, which is NULL for an empty AKI SEQUENCE (DER 30 00) even when parsing succeeds.

A path traversal vulnerability was found in Cockpit CMS's Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php sanitizes the bucket name with preg_replace('/[^a-zA-Z0-9-_\.]/','', $bucket), which permits '..' and '../' sequences. The sanitized value is interpolated into a Flysystem path as uploads://buckets/{bucket}, and the WhitespacePathNormalizer resolves 'buckets/..' to the empty string (the uploads storage root) without raising PathTraversalDetected because the '..' has a preceding component to consume.

Cockpit CMS has a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php executes bucket commands (ls, upload, removefiles, rename, createfolder) without any ACL or role check. Any authenticated user, regardless of role, can perform all bucket operations on any named bucket, including buckets intended for admin use only.

9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to access sensitive user data by sending requests to unprotected API endpoints. Attackers can enumerate paginated request logs and retrieve complete AI conversation histories including system prompts, user messages, assistant responses, tool calls, and user email addresses by querying the request-logs and request-details API routes which lack authentication middleware.