CVE Vulnerability Catalog

In Traefik from 3.6.11 until 3.7.13, checkPassword in BasicAuth constructs the singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames coalesce on one key while configured usernames perform separate password hashes, creating an unauthenticated timing discrepancy that reveals whether a username exists. Sequential checks remain cost-equalized, Traefik v2 and Digest authentication are not affected, and the issue does not disclose credentials or bypass authentication.

A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.

In radare2 prior to 6.2.0, the Windows 64-bit crash-dump (dmp64) parser was vulnerable because it used an input-controlled physical-memory-run PageCount directly as the bound of a per-page allocation loop. The vulnerability is triggered by opening a small crafted full-memory Windows crash dump. The parser repeatedly allocated and appended page descriptors without validating the count against the dump size, causing denial of service through excessive memory consumption and processing time.

In radare2 prior to 6.2.0, the NE relocation fixup-chain parser was vulnerable because it followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by opening a crafted NE executable whose in-bounds relocation entry points back to itself instead of reaching 0xffff. The parser repeatedly processed the same relocation and allocated another relocation object on each iteration, causing denial of service through continuous CPU and memory consumption.

In radare2 prior to 6.2.0, the Apple Preferred Executable Format (PEF) loader was vulnerable because it accepted relocSecCount values not bounded by the number of sections or complete relocation records in the input. The vulnerability is triggered by normal binary-format auto-detection of a small crafted Apple PEF file. The loader could perform up to 268,435,456 relocation-section iterations and repeated buffer operations after record offsets passed the end of the file, causing denial of service through excessive CPU consumption and prolonged processing.

In radare2 prior to 6.2.0, ELF PN_XNUM handling was vulnerable because the ELF parser allocated the program-header array using the resolved PN_XNUM count but several consumers still iterated with the original e_phnum value of 65535. The vulnerability is triggered by processing a crafted ELF file with e_phnum = 0xffff and a much smaller resolved count in shdr[0].sh_info. Consumers iterated beyond the allocated program-header array, causing a heap out-of-bounds read and process termination, resulting in denial of service; memory disclosure and code execution have not been demonstrated.

In radare2 prior to 6.2.0, the CPython bytecode .pyc marshal parser was vulnerable because the CPython marshal readers accepted a 32-bit string length without rejecting values that overflow the size-plus-one allocation. The vulnerability is triggered by opening or inspecting a crafted .pyc file through r2 or rabin2. A length of 0xffffffff wrapped the allocation to zero before the common byte reader wrote attacker-controlled data and fill bytes beyond the heap allocation, causing heap memory corruption and denial of service; arbitrary code execution is possible but has not been demonstrated.

In Cloudreve prior to 4.18.0, the ValidateExternalURL server-side request forgery (SSRF) guard in pkg/request/ssrf.go passes resolved addresses to checkIP without decoding NAT64, IPv4-compatible, and 6to4 IPv4-in-IPv6 transition forms. An authenticated user with remote-download access can provide SrcUri through RemoteDownloadTask.createDownloadTask so a wrapper embedding a loopback, private, link-local, or cloud metadata IPv4 address is classified as public and fetched, exposing internal service responses and cloud instance credentials. IPv4-mapped IPv6 addresses remain blocked because Go converts that form with net.IP.To4.

webpy web.py 0.76 is vulnerable to Session Fixation. The Session._load() component reads session_id directly from the request cookie and loads that session from the store, and _save() writes back under the same session_id; there is no rotation after authentication, so a fixed session_id keeps the authenticated state.

webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.__init__().

In Novu prior to 3.18.0, integration mutation use cases including remove-integration, update-integration, auto-configure-integration, and set-integration-as-primary look up an integration by integrationId and organizationId without consistently enforcing environmentId. A caller with access to one environment in an organization can target an integration identifier from another environment and delete the integration, modify its credentials, change the primary provider, or trigger auto-configuration. The repository advisory defines both environment API keys and dashboard sessions as affected. The 3.18.0 change enforces the environment boundary only for environment-scoped API-key authentication, while its tests intentionally retain cross-environment dashboard-session behavior, so it does not completely remediate the advisory-defined scope. Version 3.18.0 is a partial fix attempt, and the dashboard-session behavior requires curator resolution.

Novu before version 3.18.0 does not validate chat webhook URLs from various sources, passing them to raw HTTP requests. An authenticated user can send POST requests to internal network services, potentially causing unauthorized actions.

Novu before version 3.18.0 accepts notification redirect URLs without validating the URL scheme, allowing javascript: in the redirect attribute. When a recipient clicks the notification, JavaScript can execute in the app context, potentially exposing session data.

In MISP's UsersController login(), the pre-auth query for TOTP verification did not include the User.disabled column, so the disabled flag was not checked in that branch. Although later identify() validation still rejects disabled accounts, a TOTP-enabled user can proceed to the verification step.

In MISP, the __uploadLogo method in OrganisationsController processes a caller-supplied tmp_name with filesystem probes before verifying it is a real upload. An authenticated site-admin can supply an arbitrary server file path, allowing to check for file existence and determine image types.

In MISP, the __statisticsOrgs method uses the organization name directly as a file path component when checking for logo existence. Although the target directory does not exist, the pattern is a path traversal weakness that could allow probing arbitrary files if the directory existed.

The findOrgImage method in MISP constructs a file path from an organization identifier without validation, allowing path traversal. An authenticated user with ability to create or import events can set an organization name with traversal sequences, enabling arbitrary file existence probing and limited file read for .png or .svg extensions.

MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group (SG) editor role can trigger this code path, allowing them to modify organization metadata that should be restricted to site administrators or users with sync permissions.

In MISP, the EventReport::uploadPicture method processes a caller-supplied tmp_name field by invoking file_exists(), mime_content_type(), and exif_imagetype() on the supplied path before verifying that the value was a genuine PHP upload via is_uploaded_file(). An authenticated user holding the perm_add permission could supply an arbitrary filesystem path as the tmp_name value. The application would then probe that path and return distinct validation error messages depending on whether the file existed, its MIME type, or its image format, allowing enumeration of file existence and type.

MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of suggestion content within an event report, was incorrectly mapped to the wildcard permission ('*') in the ACLComponent, making it accessible to any authenticated user regardless of their assigned permissions. All analogous report-modification actions correctly required the perm_add permission, while read-only actions such as downloadAsPDF appropriately used the wildcard.