CVE Vulnerability Catalog

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a public and max-age directive, is stored and then re-served to a later caller that matches the same cache key. As a result one caller's cookie is disclosed to a different caller, and an untrusted server can inject cookies into cached responses served to all subsequent callers. This violates the requirement that a shared cache must not store cookies. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

A Cross-Site Scripting (XSS) vulnerability in Netgate pfSense Plus software versions <= 26.03 and pfSense CE software versions <= 2.8.1 exists in the captive_portal_status.widget.php file. A remote attacker can exploit this to execute arbitrary code in the victim's browser.

A Cross-Site Scripting (XSS) vulnerability in the RSS Widget of Netgate pfSense Plus (versions 26.03, 25.11.1) and pfSense CE (version 2.8.1) allows remote authenticated attackers to inject arbitrary JavaScript via malicious content in an RSS feed title. The injected script executes in the browser of any authenticated user who views the dashboard, due to insufficient sanitization of feed title data before rendering in the widget.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to corrupt memory due to an integer underflow.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to an integer overflow.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a memory leak.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to inject parameters into a CL command due to improper neutralization of special elements.

IBM Langflow OSS versions 1.0.0 through 1.10.2 contain a server-side request forgery (SSRF) vulnerability. A remote authenticated attacker could exploit this to obtain sensitive information.

IBM Langflow OSS versions 1.0.0 through 1.10.2 have an improper authorization vulnerability. A remote authenticated attacker could obtain sensitive information and inject messages into workflow history.

IBM Langflow OSS versions 1.0.0 through 1.10.2 have a vulnerability due to improper limitation of a pathname to a restricted directory. A remote authenticated attacker could obtain sensitive information.

IBM Langflow OSS versions 1.0.0 through 1.10.2 have a directory traversal vulnerability. A remote attacker could send a specially crafted URL request containing 'dot dot' sequences to view arbitrary files on the system.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a local attacker to delete historical flight-recorder archives due to improper access control in an SQL procedure.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a buffer overflow.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to an off-by-one write in the LPD queue name parser.

IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.1 and 12.0.1.0 through 12.0.12.28, and IBM Integration Bus for z/OS versions 10.1.0.0 through 10.1.0.7 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.

IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.1 and 12.0.1.0 through 12.0.12.28, and IBM Integration Bus for z/OS versions 10.1.0.0 through 10.1.0.7 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.

IBM App Connect Enterprise and IBM Integration Bus for z/OS write credentials in cleartext to trace logs. A local attacker could access this sensitive information.

IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to uncontrolled recursion, which could lead to denial of service. A local attacker could exploit this.

IBM i versions 7.6, 7.5, 7.4, and 7.3 have predictable server seeds, allowing a remote authenticated attacker to bypass security restrictions.