CVE Vulnerability Catalog

Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation. FastAPI HTTP middleware does not execute for WebSocket upgrade requests on specified endpoints, enabling attackers to exploit this vulnerability.

A vulnerability in Starlette 1.0.1 and earlier on Windows allows SSRF via UNC paths. When the server validates the path, it sends an SMB request to the attacker, leaking NTLMv2 credentials. The issue affects default follow_symlink=False deployments, including frameworks like FastAPI.

A vulnerability in the undici library causes the requestTls option to be silently dropped when using ProxyAgent with a SOCKS5 proxy. The HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store instead of user-configured settings.

In the undici library, a vulnerability allows Socks5ProxyAgent to reuse a single connection pool across different origins without verifying origin match. This causes cross-origin request routing, credential leakage, and potential HTTPS downgrade to HTTP.

Envoy, an open-source edge and service proxy, has a vulnerability in HTTP/2 downstream request processing. An unauthenticated remote client can trigger excessive memory consumption, leading to OOM termination and denial of service. The issue stems from incomplete accounting of cookie header bytes during request header size validation and a missing limit on total decoded header size in HPACK.

An Out-of-bounds Read vulnerability in RTI Connext Micro (Core Libraries) allows overread of buffers. This issue affects Connext Micro versions from 4.0.0 before 4.3.0 and from 2.4.5 before 2.4.*.

Missing authentication for a critical function in RTI Connext Professional (Security Plugins) allows identity spoofing. The vulnerability affects versions from 5.3.0 to 7.4.0 before 7.7.0.

An out-of-bounds write vulnerability has been discovered in RTI Connext Professional, affecting Queueing Service, Core Libraries, and Persistence Service. This issue can lead to buffer overflows in versions from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.3, and from 6.1.0 before 6.1.*.

A heap-based buffer overflow vulnerability in RTI Connext Professional Core Libraries allows overflow of variables and tags. This issue affects multiple versions of the product.

The undici WebSocket client in version 8.1.0 does not enforce the cumulative size of fragmented uncompressed messages, leading to unbounded memory growth. A malicious WebSocket server can stream many small fragments that pass validation but collectively exceed the configured limit, resulting in memory exhaustion and denial of service.

Picklescan before version 1.0.3 contains a scanning bypass vulnerability in the scan_pytorch function. By using dynamic eval and the __reduce__ trick, attackers can embed malicious magic numbers in PyTorch payloads that evade picklescan detection.

Picklescan before 0.0.35 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to read arbitrary server files by chaining io.FileIO and urllib.request.urlopen.

Dell AIOps Collector versions prior to 1.18.3 contain a 'Use of Default Credentials' vulnerability. A low privileged attacker with console access could potentially exploit this vulnerability to gain Filesystem access.

A vulnerability in Cisco ISE and ISE-PIC could allow an unauthenticated, remote attacker to view sensitive information on an affected device. This issue is due to improper authorization checks when accessing resources.

The undici WebSocket client does not limit the number of message fragments, allowing a malicious server to send many small continuation frames. This causes unbounded memory growth and denial of service (DoS).

PickleScan before 0.0.33 fails to include the pty.spawn function in its unsafe globals list, allowing attackers to bypass security checks. Malicious actors can craft pickle payloads using pty.spawn to achieve arbitrary code execution when files are processed by PickleScan.

In version 1.0.0 of the python-pdfkit library by JazzCore, the from_string method allows the execution of JavaScript code within the context of the server application and the exfiltration of local files.

Nexi Payments Nexi XPay has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.

Missing authorization in the server management routes in Azuriom CMS before version 1.2.11 allows an authenticated attacker with admin.access permission to create AzLink server tokens and take over non-admin user accounts by changing their passwords and email addresses.

Dell PowerFlex Manager versions prior to 5.1.0.1 contain an Improper Authentication vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, and Unauthorized access.