CVE Vulnerability Catalog

A vulnerability in the Netty library causes permanent leakage of pooled direct-memory buffers in the RedisArrayAggregator handler when a Redis pipeline connection closes before RESP array aggregation completes. The handler retains child messages without releasing them on channel inactivation, leading to exhaustion of the direct-memory pool. The issue is fixed in versions 4.1.135.Final and 4.2.15.Final.

A vulnerability in Netty's `DnsResolveContext` allows DNS Cache Poisoning due to insufficient validation of NS record bailiwick. An attacker controlling an authoritative DNS server for a subdomain can inject fake A records for parent domains into the cache, redirecting traffic.

A code injection vulnerability in ChromaDB version 0.4.17 and later allows an authenticated attacker with UPDATE_COLLECTION permission to execute arbitrary code on the server by sending a malicious model repository with trust_remote_code set to true.

A vulnerability in ChromaDB allows bypassing authorization controls by using V1 endpoints, which pass None for tenant and database to the authorization layer.

The SimpleRBACAuthorizationProvider in versions 0.5.0 or later of the ChromaDB Python project has a vulnerability that allows evaluating user permissions without checking which tenant, database, or collection those permissions apply to.

ChromaDB version 0.4.17 and later lacks authorization validation, allowing any authenticated user to arbitrarily read, write, update, or delete data in any tenant's collection regardless of their tenant membership.

The use of insecure HTTP transport within AMD optional tools could allow an attacker to conduct a man-in-the-middle attack, potentially leading to arbitrary code execution.

The Yarbo cloud does not enforce per-device or per-user authorization. Any client with valid credentials can subscribe to wildcard topics covering all robots globally and publish to any robot's command topic using only the robot's serial number.

A vulnerability in WEOLL by Global IT Informatics Services Inc. allows unrestricted upload of files with dangerous types, leading to access to functionality not properly constrained by ACLs.

Nuxt is an open-source web development framework for Vue.js. From versions 3.11.0 to before 3.21.7 and 4.0.0 to before 4.4.7, there is a route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher. This issue has been patched in versions 3.21.7 and 4.4.7.

In versions prior to 3.11.4, the vm2 library has a vulnerability in the BaseHandler.set method that ignores the receiver parameter and incorrectly writes to the target object. This leads to inherited properties leaking to the host object, creating an attack vector for dangerous cross-realm Symbol keys.

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM allowed excluding public network modules, but underscored internal HTTP modules like _http_client and _http_server were not blocked, enabling HTTP requests despite the exclusion of public modules.

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, Symbol.for override in setup-sandbox.js only intercepts 2 of 9 dangerous Node.js cross-realm symbols, allowing for the acquisition of real cross-realm symbols and control over host-side behavior.

In Netty library netty-transport-sctp prior to versions 4.1.135.Final and 4.2.15.Final, there is a resource exhaustion vulnerability. For each incomplete SctpMessage fragment, the handler creates a new CompositeByteBuf, leading to recursive buffer nesting. An attacker can send small fragments without the 'complete' flag, causing unlimited growth of the data structure and potential memory exhaustion.

A vulnerability in the Netty library involves missing validation of the origin (bailiwick) of CNAME records in DNS responses. The DnsResolveContext does not verify whether the CNAME record originates from an authoritative source, potentially leading to DNS cache poisoning attacks.

In Netty prior to versions 4.1.135.Final and 4.2.15.Final, the SslClientHelloHandler.decode() method is vulnerable to excessive memory allocation. When the ClientHello does not fit in the first record, the handler allocates a buffer of handshakeLength size, and default SniHandler/AbstractSniHandler constructors disable safeguards (maxClientHelloLength=0, handshakeTimeoutMillis=0). A 16 MiB request triggers immediate huge/unpooled allocation, retained until the channel closes.

The vulnerability in the Netty library concerns the default QUIC token handler (NoQuicTokenHandler), which unconditionally accepts any token as valid. An attacker can send an Initial packet with an arbitrary token and a spoofed victim source IP, causing the server to treat the victim as validated and send full responses without the 3× amplification limit.

In the Netty library, specifically in netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, there is a memory leak vulnerability. When decoding a PP2_TYPE_SSL TLV, if the attacker sets the TLV length below 5 bytes, an IndexOutOfBoundsException is thrown and not properly handled, causing a retained slice on the pooled cumulation buffer to never be released.

A security flaw has been discovered in PbootCMS up to version 3.2.12 in the retrieve function of the file apps/home/controller/MemberController.php of the Password Handler component. Manipulation of the arguments username/password/email/checkcode results in weak password recovery.

MobaXterm Personal Edition (Portable) version 26.3 (Build 5154) allows arbitrary code execution by loading a malicious DLL located in the same directory as the executable. The application automatically loads the winspool.drv library from that location during startup.