CVE Vulnerability Catalog

A vulnerability in the Nokogiri library affects the `Nokogiri::XML::NodeSet#[]` method (and its alias `#slice`). The index check against the node set's bounds used a 32-bit-truncated copy of the index, allowing a large negative index to pass the check and then be used at full width, reading outside the node set's storage.

A NULL pointer dereference vulnerability was found in the Linux kernel's ALSA driver for the TASCAM US-144MKII device. A malicious USB device can have a configuration with interface number 1 but missing interface 0, leading to a system crash.

A flaw was found in systemd where uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp.

An issue was discovered in py-lmdb 0.97 where for certain values of mn_flags, mdb_cursor_set triggers a memcpy with an invalid write operation within mdb_xcursor_init1. This occurs when accessing a data.mdb file supplied by an attacker.

An issue in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host, allowing attackers to view sensitive information.

No description is available for this CVE. The details of the vulnerability cannot be determined from the provided information.

Nodemailer's process-global DNS cache is keyed only by `host`, but each cache entry also stores the caller-specific TLS `servername`. When two direct SMTPS transports use the same DNS host with different `tls.servername` values, the first transport's server name is returned to the second.

When `enable_jsonp=True`, oauthlib's `RevocationEndpoint` reflects the user-supplied `callback` parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation.

A timing side-channel vulnerability exists in the PKCE (RFC 7636) implementation of the Authorization Code Grant flow. The `code_challenge_method_plain` function uses Python's standard `==` operator for string comparison instead of a constant-time comparison function, potentially allowing attackers to guess values.

Improper input validation in Intel PROSet/Wireless WiFi software for Linux before version 23.20 may allow an unauthenticated user to potentially enable denial of service via adjacent access.

A vulnerability in telnet in GNU inetutils through version 2.7 allows servers to read arbitrary environment variables from clients via the NEW_ENVIRON SEND USERVAR command.

In udev in systemd before version 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.

A memory-related vulnerability has been discovered and fixed in the librsvg dependency. Under certain runtime-specific conditions, it can lead to possible remote code execution (RCE) on glibc-based Linux.

A vulnerability in the Linux kernel related to the SDMA block has been fixed, which caused a NULL pointer issue in buffer functions when the SDMA block was not enabled.

In systemd versions 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file in nspawn.

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.

In OpenPrinting CUPS, versions 2.4.16 and prior, a use-after-free vulnerability exists in the CUPS scheduler (cupsd) when temporary printers are automatically deleted.

A vulnerability in the Linux kernel related to the libceph library has been resolved, concerning key length verification. The new CEPH_MAX_KEY_LEN check ensures that the key material fits into a fixed-size buffer.

The faraday-http-cache library acts as a shared cache by default (shared_cache: true). The ByUrl strategy keys entries on method and URL and treats a cached response without a Vary header as matching every request, while the ByVary strategy relies on the origin listing Authorization in Vary. A response to a request... (description truncated) may be improperly served to other users.

A vulnerability has been identified in the Linux kernel within the wifi: libertas module, which has been resolved. The usb_tx_block() function submits cardp->tx_urb without ensuring that any previous transmission on this URB has completed.