CVE Vulnerability Catalog

Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode is set. Impact: TLS and DTLS connections using raw public keys...

The email module in Python, specifically the BytesGenerator class, improperly quotes newlines in email headers during serialization, allowing header injection. This only affects usage of LiteralHeader that does not respect email folding.

Vulnerability in Intel processors allows exposure of sensitive information via shared microarchitectural predictor state during transient execution in VMX non-root (guest) operation. An unprivileged software adversary with an authenticated user can exploit this state to access data.

A flaw was found in the libnbd library where a malicious actor could exploit a specially crafted URI to convince libnbd to open it. The vulnerability arises from the incorrect interpretation of non-standard hostnames starting with '-o' as arguments to the SSH process.

Axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON, the helper behind the public axios.formToJSON() / named formToJSON API and the default request transform used when FormData is sent with an application/json content type.

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the thread/process. This might be used to DoS.

Vulnerability in the iscsi-initiator-utils package involves out-of-bounds write and information disclosure via unvalidated IPv6 payload length. Crafted ICMPv6 Echo requests can cause the iscsiuio daemon to trust an inflated ipv6_plen larger than the actual received payload.

Axios versions starting with 0.28.0 contain uncontrolled recursion in formDataToJSON, which is exposed as axios.formToJSON() and used internally when axios serialises FormData with Content-Type: application/json. If an application passes attacker-controlled FormData field names, it can lead to stack exhaustion.

libcurl supports pinning of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, but fails to specify that it does not for QUIC.

Several vulnerabilities have been discovered and fixed in the upstream libvips dependency, two rated as high severity using CVSSv4. Versions of sharp prior to 0.35.0 processing untrusted input are affected.

A vulnerability in the XML::Parser library for Perl (up to version 2.45) causes a heap buffer overflow, leading to double free or corruption and crashes. The issue occurs in the parse_stream() function in Expat.xs when the :utf8 PerlIO layer is used, because Perl returns decoded characters while SvPV() expects raw bytes.

`NestedSecretsSettingsSource` reads secret values from files in a configured `secrets_dir`. When `secrets_nested_subdir=True`, a directory entry inside `secrets_dir` that is a symbolic link pointing outside `secrets_dir` is followed, allowing access to files outside the configured directory.

An issue was discovered in versions 6.0 before 6.0.5 and 5.2 before 5.2.14 regarding response headers that do not vary on cookies if a session is not modified, while `SESSION_SAVE_EVERY_REQUEST` is set to `True`. A remote attacker can steal a user's session after that user visits a cached public page.

The development server contains a path traversal vulnerability on Windows when serving files from `servedir`. Due to the use of `path.Clean()` (which only normalizes forward-slash `/` separators) instead of a Windows-aware path normalization function, it is possible to craft malicious requests.

A vulnerability in PCRE before version 8.43 allows a subject buffer over-read in JIT when UTF is disabled and \X or \R has more than one fixed quantifier, related to CVE-2019-20454.

Granian is a Rust HTTP server for Python applications. From versions 0.2.0 to 2.7.4, Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value.

An issue was discovered in versions 6.0 before 6.0.5 and 5.2 before 5.2.14 in `django.middleware.cache.UpdateCacheMiddleware`, which erroneously caches requests where the `Vary` header contained an asterisk (`'*'`). This can lead to private data being stored and served.

An issue was discovered in versions 6.0 before 6.0.5 and 5.2 before 5.2.14 related to ASGI requests that can bypass the `FILE_UPLOAD_MAX_MEMORY_SIZE` limit when the `Content-Length` header is missing or understated. This may lead to large files being loaded into memory, causing service degradation.

A vulnerability in the virtio-gpu module of the Linux kernel involves an incorrect overflow check when allocating 2D images. This flaw can lead to a buffer overflow, potentially enabling privilege escalation or system crash.

Crass recursively parses CSS simple blocks and functions without a depth guard, allowing an attacker to cause stack overflow or excessive memory usage via deeply nested blocks.