CVE Vulnerability Catalog

A flaw in GnuPG before version 2.2.18 allows certificate signature forgery using SHA-1 collision attacks. An attacker can create forged certificate signatures, compromising authentication integrity.

In GCC 4.1 through 8, the stack_protect_prologue and stack_protect_epilogue functions for ARM targets generate instruction sequences that spill the address of the stack protector guard. This allows an attacker to bypass the stack protector mechanism.

In the POWER9 backend of GCC before version 10, optimization of multiple calls to the __builtin_darn intrinsic into a single call reduces the entropy of the random number generator. This occurs because a volatile operation was not specified.

A vulnerability in systemd causes systemd-coredump to ignore the kernel's fs.suid_dumpable setting, potentially leading to a local information leak.

A vulnerability in the libcurl library causes a memory leak when handling HTTP/2 server push. When an application allows server push and the number of headers exceeds the limit of 1000, libcurl aborts the push but fails to free previously allocated headers.

CPAN.pm before version 2.35 does not verify TLS certificates when downloading distributions over HTTPS. This allows man-in-the-middle attackers to replace downloaded packages with malicious ones.

The vulnerability in python-cryptography 3.2 allows Bleichenbacher timing attacks on the RSA decryption API. Attackers can exploit timing differences in processing valid PKCS#1 v1.5 ciphertext.

In GraphQL-Ruby before version 2.6.6, when using Execution::Next, authorization failures did not properly halt execution for fields using GraphQL::Schema::Resolver and its subclasses (including Mutation, RelayClassicMutation, and Subscription).

The pip package before version 19.2 for Python is vulnerable to directory traversal when a URL is provided in an install command. An attacker can exploit a Content-Disposition header containing '../' in the filename to overwrite files, such as /root/.ssh/authorized_keys.

A flaw in shadow-utils fails to properly clear the buffer when a new password is entered twice and the second attempt fails. This leaves the first password in memory, potentially allowing an attacker with sufficient access to retrieve it.

A vulnerability was found in the brace-expansion library up to versions 1.1.11, 2.0.1, 3.0.0, and 4.0.0, involving inefficient regular expression complexity in the expand function in index.js. The attack can be launched remotely.

A vulnerability in the hoek library before version 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function. An attacker can exploit this flaw to modify object prototypes, leading to unauthorized access or code execution.

Vulnerability in CPAN 2.28 allows signature verification bypass. An attacker can supply unauthorized code that is treated as properly signed.

An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.

A vulnerability in the axios library allows sending requests to absolute URLs instead of relative ones, potentially leading to SSRF attacks and credential leakage. Even with baseURL set, axios ignores it and sends the request to the specified absolute URL.

A vulnerability in the OpenSSL library allows unbounded memory growth when processing TLSv1.3 sessions in certain non-default server configurations. An attacker can exploit this to cause a Denial of Service (DoS).

A vulnerability in the Go standard library (net/netip) causes IsPrivate, IsLoopback, and similar methods to mishandle IPv4-mapped IPv6 addresses, returning false for addresses that would return true in their traditional IPv4 forms.

A vulnerability was found in systemd where a service using the DynamicUser property can create a SUID/SGID binary that remains executable with the transient service UID/GID even after the service terminates. A local attacker could exploit this to access resources owned by a potentially different UID/GID.

Processing a maliciously formatted PKCS12 file may cause OpenSSL to crash, leading to a potential Denial of Service attack. Applications loading PKCS12 files from untrusted sources might terminate abruptly.

In nodemailer v9.0.0, the message-level `raw` option bypasses `disableFileAccess` and `disableUrlAccess` protections, enabling arbitrary file reads and full SSRF (Server-Side Request Forgery) in the sent message.