CVE Vulnerability Catalog

A vulnerability was identified in tsi-coop tsi-dpdp-cms up to version 0.5.0 in the file InterceptingFilter.java of the Bootstrap Setup Endpoint component. Manipulation leads to missing authentication. The attack can be initiated remotely, and the exploit is publicly available.

A vulnerability was found in tsi-coop tsi-dpdp-cms up to version 0.5.0 in the file web.xml of the Admin Console/DPO Compliance Console component. Executing a manipulation leads to missing authentication. The attack can be launched remotely, and the exploit has been publicly disclosed.

A vulnerability was found in ntegrals openbrowser up to version 067fc45d649baa961750da8e2f4a75d87c5c75c8 in the file packages/core/src/agent/agent.ts of the Browser Agent Message Construction component. Performing a manipulation results in resource consumption. The attack can be initiated remotely, and the exploit has been made public.

In HTTPX2 prior to version 2.11.0, a vulnerability was found in Request._prepare() in src/httpx2/httpx2/_models.py. It can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault() processing checks each default header independently rather than treating the two framing headers as mutually exclusive. This can allow request smuggling or connection desynchronization.

In HTTPX2 prior to version 2.11.0, a vulnerability was found in FileField.render_headers() in src/httpx2/httpx2/_multipart.py. It directly interpolates attacker-controlled content_type values and custom headers from the files= tuple into multipart/form-data part headers without validating header names or values. CR or LF characters can terminate a part header, inject additional part headers, or end the part header block early, allowing a downstream multipart parser to treat attacker-supplied lines as genuine headers and potentially alter part semantics or bypass header-based checks.

In HTTPX2 from version 2.5.0 until 2.10.0, a vulnerability was found in the Server-Sent Events parser in src/httpx2/httpx2/_sse.py. The _SSELineDecoder.decode() method repeatedly copies and rescans buffered text when an attacker-controlled or compromised SSE endpoint splits one unterminated line across many response chunks. The total processing work grows quadratically with the line length, allowing a crafted stream to consume excessive CPU and block a synchronous worker or asynchronous event loop.

In LiteLLM prior to versions 1.88.6 and 1.96.2, a vulnerability allowed any authenticated proxy user to redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials to that destination. Request validation in several files used incomplete checks that did not cover every sensitive parameter or inspect equivalent values across nested request fields, path values, and bracket-notation form data. Routing and credential parameters including api_base, base_url, model_list, fallbacks, and litellm_credential_name could therefore be applied without clearing the operator's stored key, exposing upstream provider credentials and other configured secrets and permitting server-side requests to internal services reachable by the proxy.

In libjxl before 0.12, an integer underflow vulnerability exists in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to size_t on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse attacker-controlled codestream bytes as phantom box headers, enabling injection of arbitrary metadata (Exif, XMP, IPTC, JUMBF) and potential out-of-bounds reads.

Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to be masked from all API responses. This issue affects versions 3.2.0 through 3.95.x, and is fixed in version 3.96.0.

An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1/repositories/{repositoryName}) in Sonatype Nexus Repository 3 allowed an account holding read or browse permission on a group repository to retrieve metadata for member repositories on which it held no direct permission, by requesting the endpoint directly for the member repository name. For proxy repositories, the disclosed metadata includes the configured remote URL, which may reveal internal upstream hostnames.

A user with permission to deploy artifacts to a hosted Maven repository can upload a POM file with an oversized metadata field. This permanently breaks listing or browsing of that repository's components until an administrator repairs the data. Only the targeted repository is affected; others remain unaffected.

Boruta, a standalone authorization server implementing OAuth 2.0 and OpenID Connect, prior to version 0.10.0 logged sensitive values in business event logs. These could include access tokens, refresh tokens, authorization codes, agent tokens, direct-post codes, ID tokens, VP tokens, and tokens submitted to introspection or revocation endpoints. An attacker with log access could recover these credentials and use them until expiration or revocation.

DSpace, a repository application, in versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc1 to before 10.0, has a path traversal vulnerability via the COAR Notify / LDN service. The attacker must already have DSpace administrator credentials. When reading a file input stream of an inbound pattern/template used to generate an LDN message, the LDN class does not check for path traversal or restrict templates to a known base path. This could allow reading and interpreting an untrusted file from elsewhere in the file system as an Apache Velocity template.

DSpace, prior to versions 7.6.7, 8.4, 9.3, and 10.0, in the Curation Task feature allows an output path to be used by the reporter (-r parameter) without restricting it to a base path. This means any path writable by the DSpace (often 'tomcat') user is allowed, constituting a path traversal vulnerability in the curate script.

DSpace, prior to versions 7.6.7, 8.4, 9.3, and 10.0, when ingesting an aggregated ORE resource by URI (using the OAI-ORE Harvester), the ORE Ingestion Crosswalk does not validate the URI scheme. This may allow local file inclusion via malicious paths like file:///etc/passwd. The attacker must already have DSpace collection administrator privileges.

The agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scanning by shipping malicious __pycache__ entries alongside benign source files. Attackers can execute arbitrary Python bytecode on import while the scanner reports a CERTIFIED verdict with high trust scores.

claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python source, bytecode, and other artifacts in the scripts directory. Attackers can distribute skills with malicious code in non-manifest files that receive a SAFE verdict with 100/100 trust score despite containing unanalyzed executable payloads.

Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside malicious compiled bytecode that executes on import while the scanner reports a safe verdict, enabling code execution when operators install the skill.

Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a request to "/appX/admin" resolved internally to the protected "/admin" route while middleware observed "/appX/admin" in context.url.pathname. In applications that authorize base-prefixed routes by inspecting context.url.pathname, an unauthenticated remote attacker could bypass pathname-based middleware authorization and reach protected routes. This issue is fixed in version 7.2.4.

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files[].url, performs a server-side fetch using "requests.get(url, allow_redirects=True)". The fetched bytes are then returned inside a ZIP response. This enables SSRF with response exfiltration. Redirect-following is enabled, and there is no timeout in the vulnerable fetch path. This issue has been patched via commit 00b7c3c.