CVE Vulnerability Catalog

A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. Impacted is an unknown function of the file model-processor.ts of the component Model Processor. The manipulation of the argument current[segment] leads to information disclosure. The attack may be initiated remotely. The identifier of the patch is 1b3bff234661ce922cbc3771be642b23ec9fd0fa. To fix this issue, it is recommended to deploy a patch.

A vulnerability was determined in a2ui-project a2ui 0.9/0.9.1. This issue affects the function updateComponents of the file basic_functions.ts of the component Update Components. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This affects only the VeloCloud VCMP tunnel protocol. A successful exploit can cause the affected process to terminate and restart, leading to temporary traffic disruption.

The DuoxMe application for Android in versions prior to 4.3.4 stores sensitive information in cleartext. An attacker with local access to the device can retrieve credentials stored by the application and impersonate the user account.

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters. The ensemble name is not sanitized before being logged, allowing the attacker to forge log entries indistinguishable from genuine ones.

When audit logging is enabled, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters in the username. The injected tabs are parsed as field separators, allowing the attacker to spoof audit results and operations.

On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The agent is automatically restarted, but repeated attacks can cause continuous restarts and a sustained denial of service.

An out-of-bounds read (buffer over-read) in HTTP Cache-Control response header parsing in the QtNetwork module in Qt 6.0.0 through 6.8.8 and 6.9.0 through 6.11.1 allows remote attackers to cause a denial of service (application crash) via an excessively large Cache-Control header value returned by an untrusted or compromised HTTP server. Only the client side is affected and 32-bit builds are not affected; the access is read-only, with no information disclosure and no code execution.

On specific platforms using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the device.

A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces. This may result in temporary multicast traffic loss during the affected period.

On affected platforms running Arista EOS with SNMP configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized configurations. An authenticated user who gains access to this information could use it for unauthorized read operations on SNMP tables or to send fraudulent trap notifications to the NMS.

On affected platforms running Arista EOS with OSPFv3 configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set of packets that can cause the Ospf3 agent to restart unexpectedly. The crash results in the loss of all OSPFv3 adjacencies on the affected device and may disrupt routing across the broader OSPF domain until the agent recovers.

On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor may cause OSPF to restart unexpectedly.

On affected platforms running Arista EOS, an authenticated user with access to gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions.

In fastify before version 5.12.5, when a route registers a response trailer via reply.trailer() and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, causing Node.js to throw while serializing response headers. The exception is not caught and becomes an uncaughtException, so a single unauthenticated HTTP/2 request to any route using trailers crashes the server process and drops all in-flight requests; it can be repeated on every restart. The issue is fixed in fastify 5.12.5.

In ZenHive mpp before version 0.16.2, use of cache containing sensitive information allows a shared HTTP cache to store a paid response and serve it to clients that never paid. MPP.Plug.verify_credential sets payment-receipt and cache-control: private, but a mounting application can override them, e.g., by setting cache-control: public, allowing a CDN or reverse proxy to store the paid response and serve it to unpaid clients. Additionally, non-2xx responses may still carry Payment-Receipt.

In ZenHive mpp before version 0.16.2, improper validation of unsafe equivalence in input allows an unauthenticated remote client to pass the Tempo duplicate-submission gate twice with one signed transaction. MPP.Methods.Tempo reserves the pre-broadcast dedup slot based on caller-supplied hex, not on a canonical form, allowing two different reserve keys for the same transaction (e.g., v=27 and v=0). As a result, both pass the reserve and reach the broadcast path, and a node may return a second valid Payment-Receipt for a single on-chain payment.

In the Apache Airflow Akeyless secrets backend, the team-scope guard can be bypassed with a user-controlled key. A Dag author scoped to one team can supply a Variable key containing a path separator, causing the backend to resolve a secret belonging to a different team.

In Ash before version 3.33.4, field policies are documented to protect against filter-based information disclosure, but the nilling was applied only to attributes, not to calculations or aggregates. A user can reference a calculation or aggregate in a filter that they cannot see, and use the filter as an oracle to read the protected value (e.g., filter(secret_calc == "x")).

NLnet Labs Unbound up to and including 1.26.0 is vulnerable to algorithmic complexity attacks (known as 'ReTrap') that cause service degradation. Attacks include TagTrap (large number of mismatched DNSKEY, RRSIG, DS records), DelegationTrap (costly iterative validation for deeply nested domains), NsecTrap (excessive invalid NSEC records), and AdditionalTrap (default validation of ADDITIONAL section).