CVE Vulnerability Catalog

The node-tar library before version 7.5.19 does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio during extraction and parsing. This allows a small crafted gzip bomb to exhaust disk space and CPU.

A vulnerability in the js-yaml library (JavaScript YAML parser and dumper) causes quadratic CPU time growth when processing YAML documents containing a chain of mappings with merge keys. The issue affects versions from 3.0.0 to 3.14.0 and from 4.0.0 to 4.2.0.

A vulnerability in Socket.IO (versions 4.1.0 through 6.6.7) affects the Engine.IO v4 protocol polling transport. Improper closure of HTTP responses for invalid binary POST requests with Content-Type: application/octet-stream allows an unauthenticated attacker to exhaust server-side connections and sockets.

A vulnerability in Socket.IO (versions 6.5.0 through 6.6.7) allows a DoS attack by sending a crafted session ID (e.g., __proto__) during the WebTransport upgrade process. The bug causes a TypeError, leading to server crash.

A vulnerability in the Copier library (versions 9.5.0 through 9.15.1) allows bypassing the trust mechanism for templates. The prefix check uses raw `str.startswith` without path normalization, while template fetching normalizes the path, enabling `..` sequences to point to a different, attacker-controlled template. Consequently, code from `tasks`, `migrations`, or `jinja_extensions` executes without a trust prompt.

IBM API Connect versions 12.1.0.0 through 12.1.0.3 use default credentials, which could allow an attacker to gain unauthorized access to the application before the system enforces a credential update.

Repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories. The isValidRemoteValue function in src/core/git/gitRemoteParse.ts fails to block file:// URLs, permitting attackers to supply file:// scheme URLs that bypass validation and are passed directly to git clone, enabling unauthorized access to all tracked file contents on the server filesystem.

SeaweedFS before version 4.34 does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy. This allows an authenticated user with access to one bucket to read objects from other buckets through server-side copy.

In Frigate 0.17.1, the GET /api/logs/{service} endpoint allows any authenticated user, including the viewer role, to download Frigate and nginx logs. These logs may expose auto-generated admin passwords and camera credentials, enabling viewer-to-admin privilege escalation.

A vulnerability in App::Ack through version 3.10.0 for Perl causes unsanitized terminal escape sequences from filenames to be printed in several output modes. When ack prints a filename containing terminal control bytes like ANSI escape sequences, those bytes reach the terminal unchanged. Version 3.10.0 added a _safe_filename helper that sanitizes filenames in -f, -g, colored match heading, and per-match lines, but the --show-types, -l/-L, and -c paths still emit the raw filename.

A vulnerability in App::Ack for Perl before version 3.10.0 allows memory exhaustion via an unbounded context value in a project .ackrc. Ack searches the directory hierarchy for .ackrc and loads its options, where -B and -C accept any positive integer, potentially allocating a huge buffer.

A vulnerability in App::Ack for Perl (up to version 3.10.0) allows reading arbitrary files via the --files-from option in a project .ackrc file. Ack searches the directory hierarchy for .ackrc and loads its options, but the option blocklist does not include --files-from, enabling a malicious repository to read files outside the project.

An OS command injection vulnerability exists in the start_lltd() function of the "rc" binary in Cisco RV130/RV130W (firmware 1.0.3.55) and RV110W routers (firmware 1.2.2.5/1.2.2.8). The machine_name configuration parameter is not properly sanitized, allowing an authenticated remote attacker to execute arbitrary commands with root privileges.

An OS command injection vulnerability exists in the sub_34984() function of the "rc" binary in Cisco RV130/RV130W (firmware 1.0.3.55) and RV110W routers (firmware 1.2.2.5/1.2.2.8). The lan_ipv6_prefixlen configuration parameter is not properly sanitized, allowing an authenticated remote attacker to execute arbitrary OS commands with root privileges.

An OS command injection vulnerability exists in the save_syslog_to_file() function of the "httpd" binary in Cisco RV130/RV130W (firmware 1.0.3.55) and RV110W (firmware 1.2.2.5/1.2.2.8) routers. The model_name configuration parameter is not properly sanitized, allowing an authenticated remote attacker to execute arbitrary OS commands with root privileges.

An OS command injection vulnerability exists in the start_bonjour() function of the 'rc' binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5/1.2.2.8. The wan_hostname configuration parameter is not properly sanitized, allowing an authenticated remote attacker to execute arbitrary OS commands with root privileges.

Snowflake Terraform Provider versions prior to 2.18.0 contain SQL injection and DDL injection vulnerabilities. An attacker can exploit unsanitized data source inputs to execute arbitrary SQL queries with the provider's privileged session, enabling data exfiltration and creation of long-lived access credentials. Improper identifier sanitization in user resources allows DDL injection, potentially creating accounts with attacker-controlled credentials.

An XSS vulnerability was found in the Ad Hoc module of Progress MOVEit Transfer due to improper input neutralization during page generation. This allows an attacker to inject malicious JavaScript into a victim's browser.

This vulnerability enables large‑scale data harvesting without requiring app‑specific secrets. A single request to a minimal leaderboard component may return user records containing emails, UUIDs, and custom fields. The combination of wildcard CORS behavior, long‑lived twenty‑day JWTs, and the absence of token revocation allows attackers to gather sensitive personal information from any Adalo application.

In Adalo's no-code app builder (Versions 1 and 2), attackers may extract full user records and correlate user behavior across multiple applications via dbId enumeration. The platform does not implement data minimization, privacy by design, or appropriate technical safeguards, allowing sensitive information to be exposed to unauthorized parties.