CVE Vulnerability Catalog

GitLab has fixed an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1. Under certain conditions, an authenticated user could spoof merge request authorship and attribute content to arbitrary existing users due to improper reliance on ephemeral cache state during Direct Transfer imports.

GitLab EE contains an improper authorization check that, under certain conditions, could allow an authenticated user with developer-role permissions to bypass admin-configured AI tool governance controls for workflows in namespaces they do not control. Affected versions are from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1.

A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. Affected by this vulnerability is the function chrome.runtime.onMessageExternal.addListener of the file static/background/index.js of the component External Message Handler. The manipulation of the argument body.url/paginationConfig/xPathConfig/body.urls/xPaths results in missing authorization. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A security vulnerability has been detected in weiqingwen spring-boot-forum up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f. Affected is the function validate of the file src/main/java/com/qingwenwei/util/NewUserFormValidator.java of the component Avatar Upload. The manipulation of the argument Username leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was identified in Fast FAC1900R 20190827_2.0.2. The impacted element is the function get_alias_name of the component uhttpd. Such manipulation leads to stack-based buffer overflow. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

A security flaw has been discovered in LB-Link BL-CPE600EU 5.8.13. This vulnerability affects unknown code of the file Mifi_config.bin of the component Configuration Backup Handler. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

The hpack library (HTTP/2 header encoding for Python) prior to version 4.2.0 does not bound variable-length integer decoding. Malformed input can trigger runaway computation with O(n^2) runtime, blocking further processing. The fix in version 4.2.0 restricts decoding to uint32.

IBM Concert versions 1.0.0 through 3.0.0 allows a remote attacker to traverse directories by sending a crafted URL request containing "dot dot" sequences. This enables viewing arbitrary files on the system.

IBM Concert versions 1.0.0 through 3.0.0 is vulnerable to improper access control, allowing unauthorized modification of application files.

RabbitMQ before versions 4.2.7 and 4.3.1 does not enforce an explicit match limit when compiling LIKE patterns into regular expressions, allowing an authenticated AMQP 1.0 consumer with read and write permissions on a stream queue to cause significant CPU consumption via a crafted LIKE filter. Each delivered message can cause about 100-200 ms of CPU load, amplified across thousands of messages and parallel sessions. The issue is fixed in versions 4.2.7 and 4.3.1.

RabbitMQ prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15 stores the content-header BodySize (a uint64) without validation against max_message_size. A client can declare body_size = 2^63-1 and stream fragments so the size check never fires, causing the reader process to accumulate unbounded memory. This leads to node memory exhaustion or a memory alarm, degrading all publishers cluster-wide.

RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 calls rabbit_data_coercion:atomize_keys/1 (the unsafe binary_to_atom variant) on the vhost metadata map. An administrator importing a crafted definitions file can exhaust the atom table and crash the node in a single request.

RabbitMQ prior to versions 4.2.7 and 4.3.1 coerces the URL :component segment to an atom via rabbit_data_coercion:to_atom/1 in the runtime-parameters lookup path, creating a new atom for any previously unseen value. An authorized policymaker can send roughly one million requests with distinct component values to exhaust the atom table and crash the node.

In RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, the trace consumer constructs the output path without a safe relative path check, even though the read side performs such a check. An administrator can use the name parameter to write a .log-suffixed file to an arbitrary filesystem path writable by the rabbitmq user, e.g. /etc/cron.d/x.log.

RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0: the AMQP 0-9-1 shovel removes credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET /api/shovels and rabbitmqctl shovel_status.

RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0: when a binding is created on an x-jms-topic exchange, add_binding/3 reads the rjms_erlang_selector argument and passes it through erl_scan:string/1 and erl_parse:parse_term/1. erl_scan:string/1 interns every atom literal, validate_binding/2 is a no-op with no length cap. An authenticated low-privilege AMQP user can crash the entire broker node in fewer than 100 bind calls.

RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0: add_binding/3 parses the routing key as an integer weight N and computes ring positions with lists:seq(NextN0, NextN0 + N - 1). validate_binding/2 only checks N >= 1 with no upper bound. A user with write permission on a consistent-hash exchange can create a binding with a huge weight, allocating hundreds of megabytes on every cluster node.

In RabbitMQ prior to versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0, the HTTP handler accept_content/2 calls create_super_stream without the required configure permission check on the exchange and partition queues that is present in the stream-protocol path. A user with the management tag and vhost access but no configure permission can create super-streams via the HTTP API.

RabbitMQ prior to versions 4.1.11, 4.2.6, and 4.3.0: validate_partitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq(0, 500000000) allocates roughly 8GB.

In the RabbitMQ management UI (versions prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6), TLS client certificate details such as Subject and Issuer DN are rendered without HTML escaping. The vulnerability is reachable when a TLS listener is configured with verify_peer and an attacker holds a CA-signed client certificate with an arbitrary Subject CN. When an administrator views that connection in the UI, the injected script executes in the admin's browser session, leading to account takeover.