CVE Vulnerability Catalog

Version 2.0.0 of the sigstore-java library erroneously removed verification of the integrated (Rekor entry) time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements adhering to the Sigstore verification spec. The vulnerability affects only users verifying bundles with dev.sigstore:sigstore-java:2.0.0.

Loofah from 2.25.0 until 2.25.2 does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric character references such as &#58, &#9, &#10, or &#13. CGI.unescapeHTML leaves these references encoded, so allowed_uri? reports the URL safe even though a browser decodes an encoded colon or strips encoded whitespace and executes the resulting URI scheme. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.

Loofah from 2.25.0 until 2.25.2 does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character references 	 or 
. CGI.unescapeHTML leaves those references intact, so allowed_uri? reports the URL safe even though a browser decodes and strips the tab or line feed and executes the resulting javascript: URL. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.

Trix prior to 2.1.18 is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without Input Events Level 2 support. The StringPiece.fromJSON method trusts href attributes from the JSON payload without sanitization, allowing a draggable element containing a javascript: URI to bypass DOMPurify sanitization and inject executable JavaScript into the DOM. Exploitation requires the victim to drag and drop attacker-controlled content, and server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18.

Astro prior to 8.1.2, the Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remote_images for Netlify's Image CDN allowlist. In packages/integrations/netlify/src/index.ts, remotePatternToRegex() escapes dots in hostname values but interpolates literal pathname values without escaping regular expression metacharacters such as ., +, ?, (, and [, so a restrictive pathname such as /img/v1.0/file also matches metacharacter-adjacent paths, including paths that cross a segment. Netlify enforces the generated regular expression directly and Astro's matchPattern() helper does not revalidate the request, allowing optimization of images on an already-allowed host that the declared pathname was intended to exclude. This issue is fixed in version 8.1.2.

IBM Db2 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to cause a denial of service due to a memory leak.

IBM Security Verify Access and IBM Verify Identity Access (including container versions) in certain Reverse Proxy configurations are vulnerable to a denial of service attack.

GitLab EE has a vulnerability in versions 15.6 through 19.0.6, 19.1 through 19.1.4, and 19.2 through 19.2.2 that under certain conditions could allow a user with pending membership to receive permissions granted by a custom role due to incorrect privilege assignment that did not account for membership state.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to an interpretation conflict in the multipart parser.

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known.

In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route (cmsproxy) is vulnerable to a Server-Side Request Forgery (SSRF) attack via DNS Rebinding. A Time-of-Check to Time-of-Use (TOCTOU) race condition exists between the URL validation phase and the actual HTTP request phase, allowing attackers to access internal network resources and cloud metadata endpoints. Version 0.10.4 fixes the issue.

A Server-Side Request Forgery (SSRF) vulnerability in Fortinet FortiSIEM in multiple versions may allow an attacker to execute unauthorized code or commands.

The Estatik Real Estate Plugin for WordPress before version 4.3.4 does not validate the recipient list used for messages sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body, and Reply-To on sites where the form is configured to route to a custom address.

A rogue Velociraptor client can upload a malformed sparse file that causes a panic when the GUI attempts to expand it, potentially crashing the server process. The issue is a Divide by Zero bug in the ShouldPadFile() function.

In sshd in OpenSSH before 10.5, the 'restrict' keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.

In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the [email protected] extension.

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue access-token cookies, and refresh-token cookies when provided by the identity provider, without Secure even though the browser completed login over HTTPS.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to restricted resources. Exploitation of this issue does not require user interaction.

Dozzle is a realtime log viewer for docker containers. From 10.5.2 until 10.6.15, the isBlockedIP SSRF guard in internal/notification/dispatcher/webhook.go, used by safeDialContext for webhook notification URLs, does not inspect IPv4 addresses embedded in 6to4, NAT64, Teredo, or IPv4-compatible IPv6 addresses, allowing an authenticated user to reach loopback or link-local targets that the guard intends to block. This issue is fixed in version 10.6.15.

Integer overflow in UEFI firmware for Intel(R) Slim Bootloader may allow information disclosure. A system software adversary with an authenticated user and low complexity attack may cause denial of service. The attack requires local access and user interaction.