CVE Vulnerability Catalog

An infinite loop vulnerability in the mod_proxy_ftp module in Apache HTTP Server from 2.4.0 through 2.4.67, exploitable when an attacker controls the backend FTP server. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker-controlled OCSP server. Affects versions 2.4.0 through 2.4.67.

Flowise prior to version 3.1.2 has a mass assignment vulnerability in the chatflow update endpoint. It allows an authenticated user to modify server-controlled properties such as deployed, isPublic, workspaceId, and reassign the resource to another workspace.

A heap-based buffer overflow vulnerability exists in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content. This affects versions 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Tenda FH451 router version V1.0.0.9 has a stack overflow vulnerability in the list1 parameter of the fromDhcpListClient function. An attacker can cause a denial of service via a crafted HTTP request.

Heap-based buffer overflow vulnerability in Apache HTTP Server from version 2.4.0 through 2.4.67. It can be exploited by malicious backend servers and ProxyPassReverseCookie* directives.

A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier. An attacker can exploit an untrusted backend.

Software run by a non-privileged user can perform improper GPU system calls, causing mismanagement of a mapping state for a sparse memory allocation. The product accidentally refers to the wrong memory due to the semantics of how math operations are implicitly scaled across buffers of different sizes.

Software running as a non-privileged user can perform improper GPU system calls to corrupt kernel heap memory. By creating specific resources and parameters, an attacker can corrupt kernel memory.

Vulnerability in Tenda AC18 version 15.03.05.05: stack-based buffer overflow in function sub_45304 of file /goform/getRebootStatus (Web Management Interface component). An attacker can remotely trigger overflow via the callback argument. Exploit is publicly available.

Vulnerability in Tenda W20E version 15.11.0.6: stack-based buffer overflow in function modifyWifiFilterRules of file /goform/modifyWifiFilterRules (Web Management Interface component). An attacker can remotely trigger overflow via the wifiFilterListRemark argument. Exploit is publicly available.

A stack-based buffer overflow vulnerability has been found in Tenda W20E version 15.11.0.6 in the formPortalAuth function of the /goform/PortalAuth file. Manipulation of the gotoUrl argument can lead to buffer overflow. The attack can be launched remotely and the exploit is publicly available.

A stack-based buffer overflow vulnerability has been detected in Tenda W20E version 15.11.0.6 in the formSetPortMirror function of the /goform/setPortMirror file. Manipulation of the portMirrorMirroredPorts argument leads to buffer overflow. The attack can be initiated remotely and the exploit is public.

Vulnerability in Routinator causes a crash when encountering an RRDP file with a specially crafted Document Type Definition (DTD).

When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes. This only affects users who allow API access from untrusted networks.

Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to the entire Routinator rsync cache.

Routinator exits on any error when accepting incoming HTTP or RTR connections, including recoverable ones like running out of file descriptors. An attacker can trigger this by opening many connections.

A vulnerability in the gun_http module of the gun library (Erlang/Elixir) allows a malicious HTTP server to force the client into raw protocol mode via an unsolicited 101 Switching Protocols response. The handle_inform/8 function does not check if the client sent an Upgrade or Connection: upgrade header in the request. After receiving a 101 response, gun switches to raw mode with no flow control, and the server can flood the client with arbitrary data, leading to memory exhaustion and VM crash.

A vulnerability in the gun_http module of the gun library (Erlang/Elixir) allows a malicious server to exhaust client memory via unbounded HTTP/1.1 response buffering. The handle/5 function accumulates TCP data in the connection's buffer without an upper limit when the expected terminator (e.g., \r\n\r\n) never arrives. A malicious server can send a partial response that never completes, causing continuous buffer growth and memory exhaustion of the BEAM node.

The gun library (gun_http2 module) versions 2.0.0 to 2.4.0 have an origin validation vulnerability. An unvalidated :authority header in PUSH_PROMISE frames allows cookie injection for arbitrary third-party domains, enabling session fixation and account takeover.