CVE Vulnerability Catalog

HTTPX2 before 2.10.0 fails to start TLS when using SOCKS5 proxy for wss origins because the TLS upgrade condition only recognizes https. HTTPX2 exposes this via Client.websocket() and AsyncClient.websocket() from 2.6.0 to 2.9.1, allowing plaintext transmission without certificate verification. Fixed in httpcore2 2.10.0 and HTTPX2 2.10.0.

In Sonatype Nexus Repository 3, two blobstore group management REST API endpoints did not correctly enforce authorization. A user with only nexus:blobstores:create permission could convert an existing blobstore into a group blobstore, an action requiring nexus:blobstores:update. This could lead to unauthorized modification of blobstore configuration.

In affected versions of Nexus Repository 3, the script execution endpoint did not verify whether script execution had been administratively disabled. An account with script-execution permission could continue to run previously-created scripts even after nexus.scripts.allowCreation=false, undermining the expectation that this setting fully blocks script execution.

In PREVAIL versions prior to 0.2.4, the eBPF verifier accepts ALU32 ADD and SUB instructions on pointer-typed registers without checking the is64 flag. ALU32 arithmetic zero-extends the result, destroying the upper half of the pointer at runtime, yet the program is marked safe. Any caller can submit a program that passes verification but faults at runtime. Patched in version 0.2.4.

DSpace versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc1 allow Remote Code Execution (RCE) via Velocity Templates used for COAR Notify/LDN messages. Patched in versions 8.4, 9.3, and 10.0.

Boruta before version 0.10.0 atomizes every key of the user-supplied request body via String.to_atom/1 before validation. Because String.to_atom interns atoms permanently in the BEAM atom table (default cap 1,048,576 atoms), any authenticated user can exhaust the global VM atom table, causing the BEAM to abort and crash the entire OIDC server. Patched in version 0.10.0.

TOON, a serialization of JSON for LLM prompts, prior to 2.3.1 has a prototype pollution vulnerability. Decoding attacker-controlled TOON with __proto__, constructor, or prototype keys writes through the object prototype chain instead of creating an own property, polluting Object.prototype. This could lead to denial of service or remote code execution if a suitable gadget is present.

Nuclio, a serverless framework, prior to version 1.17.4 has an incomplete fix for unauthenticated OS command injection in the dashboard on the local/Docker platform. The list-all resource path interpolates the resourceNamespace parameter unquoted into a /bin/sh -c command string, allowing an unauthenticated attacker to inject shell metacharacters via HTTP headers and execute arbitrary commands inside the dashboard container.

Nuclio, a serverless framework, prior to version 1.17.4 has an OS command injection vulnerability in the local Docker platform. The function namespace is interpolated unvalidated into a double-quoted docker ps --filter command executed via /bin/sh -c. Because the default auth kind is nop (unauthenticated), a remote attacker can inject arbitrary OS commands that run as root inside the dashboard container, which holds the Docker socket, leading to host compromise.

Nuclio, a serverless framework, from version 1.6.19 to before 1.17.2 has a vulnerability in the Dashboard build pipeline that does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the Kaniko container builder is enabled, a user with function-create permission can inject shell metacharacters and achieve arbitrary command execution inside the Dashboard container, which runs with a Kubernetes service account holding wildcard access to Secrets, Pods, Jobs, and Deployments.

Open edX Platform prior to commit 59bb6d6 has a vulnerability in the set_course_mode_price() function, which is protected only by @login_required and performs no course-level permission check. Any authenticated user, including a learner account with zero course roles, can issue a single POST request to overwrite the honor mode price and currency of any course on the platform.

Nuclio, a serverless framework, prior to version 1.16.5 has a vulnerability in the Java runtime that generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories[] values with the {{ . }} action, which performs no escaping. An attacker can embed a closing brace to break out of the repositories block and append arbitrary Groovy statements that execute unconditionally during the Gradle configuration phase.

Nuclio before version 1.16.4 contains a command injection vulnerability in the construction of the curl invocation for cron triggers. The event.headers keys and event.body are not properly sanitized, allowing injection of dangerous arguments into the command executed in the CronJob container.

Nuclio before version 1.16.0 contains a vulnerability in the project management API of Nuclio Dashboard. Any authenticated user, even without membership in the target project, can bypass OPA authorization checks on write paths (PUT /api/projects/{id}, DELETE /api/projects) and modify or delete any project along with all its associated resources.

A vulnerability in Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 running SIP Software allows an unauthenticated, remote attacker to cause a DoS condition. It is due to improper memory management when processing HTTP packets, and exploitation involves sending a continuous stream of crafted HTTP packets.

A vulnerability in Cisco IOS XR Software was discovered during an internal security review. It relates to improper checking or handling of exceptional conditions, classified as CWE-703.

A vulnerability in Cisco IOS XR Software was discovered during an internal security review. It relates to improper neutralization issues, classified as CWE-707.

A vulnerability in Cisco IOS XR Software was discovered during an internal security review. It relates to protection mechanism failure issues, classified as CWE-693.

A vulnerability in Cisco IOS XR Software was discovered during an internal security review. It relates to insufficient control flow management issues, classified as CWE-691.

A vulnerability in Cisco IOS XR Software was discovered during an internal security review. It relates to incorrect calculation issues, classified as CWE-682.