CVE Vulnerability Catalog

When parsing a multipart form in Go, limits on the total form size were not applied to memory consumed while reading a single form line. This allows an attacker to send a malicious request causing excessive memory consumption.

The html/template package in Go improperly applies rules for handling "<script", "<!--", and "</script" sequences within JS literals in <script> contexts. This may cause the template parser to prematurely terminate script contexts, leading to improper escaping of actions.

The html/template package in Go improperly handles HTML-like "" and hashbang "#!" comment tokens within <script> contexts. This can cause the template parser to misinterpret script contents, leading to improper escaping of actions.

A vulnerability in the axios library allows sending requests to absolute URLs instead of relative ones, potentially leading to SSRF attacks and credential leakage. Even with baseURL set, axios ignores it and sends the request to the specified absolute URL.

A vulnerability in Nodemailer allows bypassing the `disableFileAccess` and `disableUrlAccess` options when using `jsonTransport`. While the normal MIME streaming path enforces these restrictions, `jsonTransport` serializes the message in a way that bypasses them, potentially enabling access to local files or external URLs.

A vulnerability in the Nodemailer library allows header injection via the `list.*.comment` field, which is not sanitized for CR (`\r`) and LF (`\n`) characters. An attacker can supply a malicious value in this field, leading to email header spoofing.

Generating or checking excessively long X9.42 DH keys may be very slow. Applications using DH_generate_key() or DH_check() functions may experience long delays.

A vulnerability in libfuse versions 3.18.0 through 3.18.1 causes a NULL pointer dereference and memory leak in the fuse_uring_init_queue function. A local user can exploit this to crash the FUSE daemon or exhaust system resources.

A vulnerability in SQLite before version 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.

In glibc 2.15, a bug was introduced in the nscd daemon that causes a null pointer dereference when a not-found netgroup response is not added to the cache. This leads to a crash of nscd.

A logic error in the env utility of uutils coreutils causes incorrect parsing of command-line arguments when using the -S (split-string) option. Unlike GNU env, the uutils implementation mishandles backslashes within single quotes, leading to incompatibility.

A vulnerability was found in the Linux kernel's KVM for AMD SEV. It fails to reject attempts to synchronize vCPU state with an already encrypted VMSA after the VM has been launched.

In the Linux kernel, a vulnerability was found in the mechanism preventing timer interrupt starvation. Missing resets of the next_event_forced flag in several places, such as when the clock event state changes, may cause incorrect behavior.

The ORAS Go library can forward registry credentials configured for one origin to a different HTTP origin during registry redirects. This occurs when fetching manifests or metadata.

In the Linux kernel, a page fault occurs in the vfio/xe driver when resetting VF devices that do not support migration. The fix reorganizes initialization to decouple migration from reset.

In the Linux kernel, a vulnerability in KVM for AMD SEV-SNP was found. During SNP launch finish, the synchronization and encryption of VMSA (Virtual Machine Save Area) does not lock all vCPUs, allowing userspace to manipulate or run a vCPU while its state is being synchronized.

Missing checks in certain functions related to RMP initialization allow a local admin privileged attacker to cause misidentification of I/O memory, potentially resulting in a loss of guest memory integrity.

SQLite3 from version 3.6.0 to 3.27.2 inclusive is vulnerable to a heap out-of-bounds read in the rtreenode() function when handling invalid rtree tables.

An improper access control vulnerability in Secure Encrypted Virtualization (SEV) allows a privileged attacker to write to the reverse map page (RMP) during Secure Nested Paging (SNP) initialization, potentially leading to loss of guest memory confidentiality and integrity.

In the cryptography package for Python before version 3.3.2, sequences of update calls for symmetric encryption of multi-GB data can cause integer overflow and buffer overflow, as demonstrated with the Fernet class.