CVE Vulnerability Catalog

In the MessagePack library for C# prior to versions 2.5.301 and 3.1.7, a vulnerability exists related to union deserialization that does not enforce object depth limits. Runtime-generated deserializers do not call necessary security steps, leading to potential security issues.

MessagePack for C# prior to versions 2.5.301 and 3.1.7 contains multiple recursion paths in the JSON conversion components that do not enforce a depth limit. These paths can lead to process stack exhaustion and trigger an uncatchable StackOverflowException.

MessagePack for C# has a vulnerability in the ExpandoObjectFormatter's Deserialize method that can lead to significant CPU and memory overhead when handling large attacker-controlled maps. This issue exists prior to versions 2.5.301 and 3.1.7.

MessagePack for C# has a vulnerability that allows improper memory allocations during the decompression of Lz4Block or Lz4BlockArray data. Prior to versions 2.5.301 and 3.1.7, the validity of compressed data was not checked before allocating output buffers.

MessagePack for C# has a vulnerability that allows recursive descent into nested arrays and maps without proper depth checks. This can lead to unbounded recursion and a StackOverflowException.

In versions 4.0.0 to 4.11.5 and 5.6.5, Filament has a flaw in handling recovery codes for app-based multi-factor authentication that allows the same recovery code to be reused via concurrent submission. This issue does not affect email-based MFA and only applies when recovery codes are enabled.

In the MessagePack library for C# prior to versions 2.5.301 and 3.1.7, the MessagePackReader.ReadDateTime() method can allocate stack memory based on an attacker-controlled extension length. In the slow path for timestamp extension parsing, the extension body length is not validated before memory allocation, potentially leading to a StackOverflowException.

The MessagePack library for C# has a vulnerability in the optional LZ4 decompression path that can lead to out-of-bounds reads. An attacker can send a crafted MessagePack payload, potentially causing process termination.

Picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.autocomplete.AutoComplete.get_entity function in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when loaded by victims using pickle.load().

Picklescan before 0.0.30 (affected versions 0.0.26 and earlier) fails to detect the ensurepip._run_pip built-in function when scanning pickle files, allowing attackers to execute arbitrary code. Malicious pickle files embedding ensurepip._run_pip calls in __reduce__ methods bypass picklescan detection and achieve remote code execution upon pickle.load() invocation.

Picklescan before version 0.0.33 fails to detect the numpy.f2py.crackfortran._eval_length gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attackers can craft malicious pickle files that execute arbitrary Python code when loaded by victims who trust Picklescan's safety validation.

The http-proxy-middleware library in versions 3.0.4 to 3.0.7 and 4.1.1 has a vulnerability related to the fixRequestBody() method. When sending data in multipart/form-data format, an attacker can inject new form parts, leading to data desynchronization between the proxy and the backend.

A vulnerability in Dell Wyse Management Suite (WMS) prior to version 2605 is due to improper link resolution before file access. It allows a low-privileged attacker with local access to gain unauthorized access.

An SQL Injection vulnerability in Dell Wyse Management Suite (WMS) prior to version 2605 allows a low-privileged attacker to remotely execute unauthorized database queries. The flaw is due to improper neutralization of special elements used in SQL commands.

In Dell Wyse Management Suite (WMS) versions prior to 2605, an SQL injection vulnerability has been discovered. This flaw results from improper neutralization of special elements in SQL commands. It allows an attacker with low privileges and remote access to gain unauthorized access to the system.

Astro is a web framework that prior to version 6.4.6 had an issue with SSR apps using prerendered error pages. When an error occurred, these pages were fetched over HTTP, allowing an attacker to direct the request to an arbitrary host.

In NLTK (Natural Language Toolkit) versions prior to 3.10.0-rc1, a path traversal vulnerability exists in the nltk.data.load() function when using the nltk: URL scheme. An attacker can bypass security checks by using URL-encoded path separators (e.g., %2f, %2e%2e), allowing arbitrary file read from the filesystem.

WebP Server Go through version 0.14.4 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to read files outside the configured IMG_PATH directory by sending requests with percent-encoded backslashes (%5C) that bypass the path.Clean() sanitization in handler/router.go. Attackers can exploit the discrepancy between Go's forward-slash-only path normalization and Windows file system APIs that treat backslashes and forward slashes as equivalent to access arbitrary files on the host filesystem accessible to the server process.

Astro is a web framework that prior to version 6.3.3 had a vulnerability where components using the client:* directive inserted slot content into a data-astro-template attribute without proper escaping, allowing an attacker to inject arbitrary HTML and leading to reflected XSS during SSR.

A command injection vulnerability has been identified in the DHCP option processing logic in multiple TP-Link router models, due to insufficient validation of externally supplied DHCP option data. An adjacent attacker may exploit this vulnerability by supplying crafted DHCP responses, potentially resulting in unauthorized command execution during device initialization or provisioning workflows. This typically occurs when the device is in a factory-default or unconfigured state.