CVE Vulnerability Catalog

Tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities.

An SSRF vulnerability in the POST /api/provider-nodes/validate route in 9router allows an attacker to make server-side requests to internal addresses, including loopback and link-local, due to flaws in the assertPublicUrl guard. Additionally, internal responses may be disclosed, and the API key is forwarded to internal destinations.

A vulnerability in SitemapLoader.parse_sitemap in langchain_community/document_loaders/sitemap.py allows an attacker who controls a sitemap to point a nested sitemap entry at an internal address, even when restrict_to_same_domain is set to True. The server will fetch internal content and disclose it in returned documents.

The URLS regular expression in nltk/tokenize/casual.py, used by TweetTokenizer, contains an unbounded domain branch causing catastrophic backtracking on malicious input. A few kilobytes of text can consume seconds to minutes of CPU, enabling unauthenticated DoS. Version 3.10.1 bounds the label repetition.

Server-side request forgery (SSRF) in Microsoft Copilot in Azure allows an authorized attacker to disclose information over a network.

Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network.

Server-side request forgery (SSRF) in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network.

Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network.

Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network.

Server-side request forgery (SSRF) in Azure Data Factory allows an unauthorized attacker to disclose information over a network.

An attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer an unbounded amount of that client's data in memory, for as long as the backend container connection takes to complete — with no cap on how much accumulates or how long the wait can be stretched. This vulnerability is addressed in container version 1.2.0.

Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, SH floating-point decoders call set_reg() without checking the operands[] array size, leading to a 4-byte heap buffer overflow. This can crash the process or enable code execution. Fixed in 6.0.0-Alpha10.

CloudNativePG prior to 1.28.4 and 1.29.2 embedded cleartext role passwords in ALTER ROLE and CREATE ROLE statements. With pg_stat_statements and track_utility enabled, an untrusted tenant with pg_monitor or pg_read_all_stats could recover platform-managed passwords and execute OS commands in the database pod. Fixed in 1.28.4, 1.29.2, and 1.30.0.

Uncontrolled search path element in Windows Remote Help Defense allows an authorized attacker to perform spoofing locally.

LinkAce before version 2.5.7 does not validate URL format in the Bulk Link API endpoint, allowing an authenticated user to store a `javascript:` URI. The stored URI is later rendered as an `href` in Blade templates, and clicking it executes arbitrary JavaScript in the victim's browser, enabling theft of cookies and session tokens. Version 2.5.7 fixes this issue.

Mailu before version 2024.06.52 has a missing authorization check in the REST API, allowing any unauthenticated attacker to remove IP restrictions or update the comment field of any existing user token if the REST API is enabled. Upgrade to version 2024.06.52 includes a patch, and a workaround is to disable the REST API.

BigBlueButton before version 3.0.23 allows authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers. The method interpolates these values into breakout room visibility queries, allowing arbitrary SQL execution against the application database. This issue is fixed in version 3.0.23.

BigBlueButton before version 3.0.23 exposed /bigbluebutton/api/handleJoinExistingUser, which was a routable controller action rather than a private helper. A requester able to supply an existingUserID for an active participant could reuse that participant's session and impersonate the participant in the same meeting. This issue is fixed in version 3.0.23.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 have a vulnerability in cmdnim that may allow an unprivileged local user to execute the payload as root.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 allow a remote unauthenticated attacker to send a crafted UDP packet to a reachable RPC service, resulting in complete system unavailability and requiring an LPAR restart.