CVE Vulnerability Catalog

In libxslt before 1.1.43, xsltGetInheritedNsList has a use-after-free issue related to exclusion of result prefixes.

In libxslt before 1.1.43, numbers.c has a use-after-free because in nested XPath evaluations, an XPath context node can be modified but never restored. Affects xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.

A vulnerability in the LookPath function causes that when the PATH environment variable contains paths to executable files (rather than just directories), passing certain strings ("", ".", "..") can unexpectedly return binaries listed in PATH.

Unclear documentation of error behavior in `ParseWithClaims` in golang-jwt can lead to users not checking errors properly. Especially, if a token is both expired and invalid, the returned errors may be misleading.

SQLite3 from version 3.6.0 to 3.27.2 inclusive is vulnerable to a heap out-of-bounds read in the rtreenode() function when handling invalid rtree tables.

A certificate with a URI containing an IPv6 address with a zone ID may incorrectly satisfy a URI name constraint in the certificate chain. This vulnerability only affects private PKIs using URIs, as certificates with URIs are not allowed in the public web PKI.

A vulnerability in the Nodemailer library allows header injection via the `list.*.comment` field, which is not sanitized for CR (`\r`) and LF (`\n`) characters. An attacker can supply a malicious value in this field, leading to email header spoofing.

The vulnerability involves the ability to set an invalid value for the region input field when calling AWS services using the SDK. An actor with access to the environment where the SDK is used can set an invalid region value.

An issue in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host, allowing attackers to view sensitive information.

Generating or checking excessively long X9.42 DH keys may be very slow. Applications using DH_generate_key() or DH_check() functions may experience long delays.

SSH clients that receive SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.

A vulnerability in pip prior to version 23.3 allows injecting arbitrary configuration options into the 'hg clone' call when installing a package from a Mercurial VCS URL (hg+...). An attacker can control Mercurial configuration, modifying how and what is cloned.

A vulnerability in SQLite before version 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.

If an application using the `SSL_CIPHER_find()` function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs. This leads to abnormal termination of the running process, causing Denial of Service (DoS).

Git defines a line-based protocol used to exchange information between Git and Git credential helpers. Some ecosystems (most likely those using this protocol) may be vulnerable to attacks related to this protocol.

The vulnerability in the Nokogiri library affects the `Nokogiri::XML::Node#do_xinclude` method, which during XInclude processing removes `<xi:include>` nodes along with their children (e.g., `<xi:fallback>`) and declared namespaces. If an application previously accessed these nodes, unexpected behavior may occur.

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

A flaw was found in systemd where uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp.

LZ4 before version 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with large input. This issue can also lead to data corruption.

A vulnerability in the Nokogiri library allows calling `Document#encoding=` with an invalid encoding (e.g., a non-string or a string containing a null byte), which frees the document's current encoding string without replacing it. The document is left referencing freed memory, leading to a use-after-free condition on the next call.