CVE Vulnerability Catalog

IBM WebSphere Application Server 9.0 and 8.5 is vulnerable to a denial of service caused by sending a specially-crafted HTTP request to an administrative endpoint. A remote attacker could exploit this vulnerability to cause the server to exhaust filesystem space.

Angular before 20.3.30, 21.2.22, and 22.1.4 has a server-side rendering (SSR) vulnerability in @angular/platform-server. Serialization of untrusted input inside fallback raw-content elements (noscript, iframe, noembed, noframes) fails to escape matching closing tags, enabling arbitrary JavaScript execution.

In Angular prior to 20.3.28, 21.2.20, and 22.1.1, @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache evaluates an initially anonymous request before delegation, then a parent withInterceptors chain adds an Authorization header, cookie, or API token; although the parent cache skips the authenticated request, the child still stores the private response in TransferState serialized as JSON in the ng-state script. A later unauthenticated or unauthorized visitor can receive the cached HTML containing the earlier authenticated user's sensitive response data.

Angular before 20.3.30, 21.2.22, and 22.1.4 has a server-side rendering (SSR) vulnerability in @angular/platform-server. Serialization of ProcessingInstruction DOM nodes inside fallback raw-content elements fails to escape matching ancestor closing tags, allowing premature container termination and arbitrary JavaScript execution.

In Angular prior to 20.3.28, 21.2.20, and 22.1.0, the compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-sensitive directive host bindings because SecurityContext was derived from the declaring directive or component selector rather than the concrete host element. The mismatch is reachable through hostDirectives composition, inherited HostBinding declarations, createComponent with a custom hostElement or dynamic directives, SVG/MathML namespace elements, and tag-neutral selectors such as :not(...). Attacker-controlled href, src, action, xlink:href, or data values can therefore reach DOM attributes without Angular's built-in sanitizer and execute arbitrary JavaScript in the user's browser context.

A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authentication backend is present and a connection configured to use it.

A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the hosting application process to terminate. Reaching the issue requires an affected reactive encryption configuration that retrieves KMS credentials on demand.

Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-imported catalog objects. A caller with {{service:write}} or {{node:write}} permission may exploit this issue to remove services, checks, or nodes imported from a peered cluster without holding authority over the peer origin.

Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory before ACL authorization is evaluated. A client that can complete the internal RPC mTLS handshake may exploit this issue without holding a valid ACL token.

Concrete CMS versions 8.3.0 through 9.5.2 contain an authorization bypass in the Calendar event edit dialog. Permissions were checked against the calendar identifier supplied in the request rather than the calendar owning the targeted event, allowing a user with "Add Event" permission on one calendar to read and overwrite events on calendars they were not permitted to access.

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(). This allows an attacker to trigger an infinite loop that holds the stream monitor and blocks all other threads from accessing the stream.

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header. Attackers can split the header across multiple lines or use values like 'chunked, xchunked' to bypass validation and decode messages incorrectly.

AnythingLLM 1.16.1 and earlier allows the manager role to store meta_page_title or meta_page_favicon values via /api/admin/system-preferences, which MetaGenerator inserts into production homepage HTML without escaping. The values pass unchanged through systemSettings.js and reach MetaGenerator.generate() in server/index.js.

Tesseract 5.5.3 and earlier contains a flaw in Plumbing::DeSerialize that accepts a zero-length stack for NT_SERIES, NT_PARALLEL, or NT_REVERSED layers in a crafted .traineddata model. During LSTMRecognizer initialization, CacheXScaleFactor dereferences stack_[0] on the empty vector and invokes a virtual method through an invalid Network pointer.

The MongoDB integration for Laravel contains improper neutralization of special elements in data query logic within polymorphic relation handling. A caller-supplied relation identifier can be interpreted as a query condition rather than as a literal identifier.

The MongoDB C# Driver contains improper neutralization of regular-expression metacharacters in the LINQ query translation component. A caller-supplied character sequence can alter a regular-expression predicate generated by an affected application.

The silabser.sys driver for CP210x devices on Windows 8 allows a local unprivileged user to use incorrect driver settings to cause a kernel crash.

In Tesseract version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length_ but accepts negative code_ values from a crafted .traineddata recoder component. UnicharCompress::ComputeCodeRange can consequently produce code_range_ equal to zero, after which SetupDecoder indexes is_valid_start_ with the negative code on a size-zero vector, causing an out-of-bounds bit write and a crash or allocation failure. No fixed release is available.

Tesseract 5.5.3 and earlier fails to validate dimension consistency in NetworkIO::WriteTimeStepPart and NetworkIO::AddTimeStepPart. A crafted .traineddata file with an NT_LSTM layer can cause a heap out-of-bounds write during the first recognition step on the default LSTM engine. No fixed release is available.

Prior to rclone 1.75.1, the core does not reject parent-directory segments in source Object.Remote() values before fs/list, fs/walk, fs/sync, and fs/operations pass them to destination backends. A flat-keyspace source object store can contain a raw ".." key segment, and affected destinations use path.Join(root, remote) before EncodeDot can neutralize the segment, allowing a copy or upload to escape the configured root. This issue is fixed in version 1.75.1.