CVE Vulnerability Catalog

An off-by-one error was found in GIMP's PNM file format parser in the pnmscanner_gettoken() function. When parsing a crafted PNM file, a null terminator is written one byte past the end of a stack buffer, leading to memory corruption.

A memory leak vulnerability in OpenVPN versions 2.5.0–2.5.11, 2.6.0–2.6.20, and 2.7_alpha1–2.7.4 allows a remote attacker with a valid tls-crypt-v2 client key to cause a denial of service (DoS).

A vulnerability in Imager::File::JPEG for Perl before version 1.003 causes heap memory leak when reading JPEG files with multiple APP13 markers. The i_readjpeg_wiol function allocates a new buffer for each marker but does not free the previous one, leading to accumulated leaks.

In the Imager library for Perl before version 1.032, there is a heap out-of-bounds read vulnerability in the Imager::File::SGI module. The issue is in the read_rgb_16_rle function, which incorrectly checks the pixel count in an RLE run, leading to a read past the buffer. An attacker can exploit this by providing a crafted SGI image, potentially causing a process crash.

An Untrusted Search Path vulnerability has been discovered in B&R Industrial Automation GmbH APROL software. This issue affects versions prior to R 4.4-01P5.

An improper certificate validation vulnerability has been discovered in B&R Industrial Automation GmbH APROL. This issue affects APROL versions before R 4.4-01P5.

An inefficient algorithmic complexity vulnerability in the hpax library for Elixir allows unauthenticated denial-of-service via unbounded HPACK integer decoding. An attacker can send a small HTTP/2 header block that forces excessive CPU and memory usage. This affects hpax versions from 0.1.1 before 1.0.4.

A vulnerability in the Mint library (Mint.HTTP1 module) allows a remote server to exhaust client memory by sending a chunked transfer-encoded response with a declared huge chunk size (e.g., 2 GiB) and slowly sending data without ever completing the chunk. The client buffers all received bytes without emitting them to the caller, leading to uncontrolled memory growth and out-of-memory conditions.

The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service condition.

A vulnerability in Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` allows writing files outside the intended destination directory. An attacker with write access to the source GCS bucket can create an object with `..` segments in its name, leading to overwrite of arbitrary files on the SFTP server or the worker host.

Improper Input Validation vulnerability in Apache Camel. The flaw allows potential attacks via malicious input data.

An improper input validation vulnerability has been discovered in Apache Camel. This flaw allows an attacker to inject malicious data, potentially leading to unexpected application behavior.

An improper input validation vulnerability has been discovered in Apache Camel. This flaw allows an attacker to inject malicious data, potentially leading to unexpected application behavior.

A vulnerability in SUSE Rancher Fleet allows forgery of unauthenticated webhook requests, which can be exploited by a remote attacker to cause a denial of service (DoS) or a downgrade attack on other repositories in the system. The issue affects versions 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11, and 0.12 before 0.12.5.

A flaw in Red Hat Advanced Cluster Security for Kubernetes (RHACS) allows an authenticated user with a valid API token to send deeply nested GraphQL queries, causing excessive resource consumption in Central and resulting in a denial of service for the management plane.

A vulnerability in the Iggy component of Apache Camel allows an attacker to inject Camel control headers, including CamelHttpUri, by publishing messages to the consumed Iggy stream/topic. In a route with an Iggy consumer and an HTTP producer, this can lead to server-side request forgery (SSRF) and, via placeholder resolution, disclosure of environment variables, application properties, and vault secrets.

A vulnerability in the Atmosphere Websocket component of Apache Camel allows an attacker to inject internal Camel control headers via WebSocket query parameters. This leads to Server-Side Request Forgery (SSRF) and exposure of sensitive information such as environment variables, application properties, and vault secrets.

A vulnerability in Apache Camel's Vertx Websocket component allows an attacker to inject Camel control headers, including CamelHttpUri, via WebSocket query parameters. This leads to server-side request forgery (SSRF) and exposure of sensitive information such as environment variables, application properties, and vault secrets. Affected versions: 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, and 4.19.0 to 4.20.0.

A vulnerability in the Apache Camel CXF SOAP component allows an attacker to manipulate the operationName/operationNamespace headers to invoke an unintended WSDL operation on the backend. The lack of a Camel prefix in these headers prevents filtering at the HTTP boundary, allowing them to pass from an HTTP request into the Exchange. This enables a confused-deputy attack where a read operation can be replaced with a destructive one.

A vulnerability in the Neo4J component of Apache Camel allows Cypher injection through property names in the CamelNeo4jMatchProperties map. Although property values are bound as parameters, JSON key names are concatenated verbatim into the query, enabling an attacker to alter the query structure and perform arbitrary operations on the Neo4j database.