CVE Vulnerability Catalog

Nodemailer disables TLS certificate verification in its internal HTTPS fetch client by setting rejectUnauthorized: false in lib/fetch/index.js. This causes OAuth2 token requests to trust invalid or self-signed HTTPS certificates.

In nodemailer v9.0.0, the message-level `raw` option bypasses `disableFileAccess` and `disableUrlAccess` protections, enabling arbitrary file reads and full SSRF (Server-Side Request Forgery) in the sent message.

A vulnerability in the Go standard library (net/netip) causes IsPrivate, IsLoopback, and similar methods to mishandle IPv4-mapped IPv6 addresses, returning false for addresses that would return true in their traditional IPv4 forms.

A vulnerability in the axios library allows sending requests to absolute URLs instead of relative ones, potentially leading to SSRF attacks and credential leakage. Even with baseURL set, axios ignores it and sends the request to the specified absolute URL.

A medium severity vulnerability in CPython where regular expressions allow excessive backtracking during tarfile.TarFile header parsing, leading to ReDoS via specially crafted tar archives.

The urllib.parse.urlsplit() and urlparse() functions in Python improperly validate bracketed hosts (`[]`), accepting hosts that are not IPv6 or IPvFuture. This violates RFC 3986 and could enable SSRF attacks if a URL is processed by multiple URL parsers.

A buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to cause temporary denial of service on platforms where a 1-byte over-read leads to process termination. This affects the database server and libpq.

A TOCTOU race condition in pg_dump in PostgreSQL allows an object creator to replace another relation type with a view or foreign table, executing arbitrary SQL functions as the user running pg_dump, often a superuser. The attack requires waiting for the right moment.

Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise see.

Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g., PATH). This often suffices for arbitrary code execution, even without a database server OS user account.

A vulnerability in the hoek library before version 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function. An attacker can exploit this flaw to modify object prototypes, leading to unauthorized access or code execution.

A vulnerability was found in the brace-expansion library up to versions 1.1.11, 2.0.1, 3.0.0, and 4.0.0, involving inefficient regular expression complexity in the expand function in index.js. The attack can be launched remotely.

Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows than intended. The attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or equivalent. The problem arises when application queries use partitioning.

Client use of server error messages in PostgreSQL allows an untrusted server under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. A man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql might misinterpret.

The vulnerability in python-cryptography 3.2 allows Bleichenbacher timing attacks on the RSA decryption API. Attackers can exploit timing differences in processing valid PKCS#1 v1.5 ciphertext.

A vulnerability in systemd causes systemd-coredump to ignore the kernel's fs.suid_dumpable setting, potentially leading to a local information leak.

Incomplete tracking in PostgreSQL of tables with row security allows reused queries to view or change different rows than intended. Fixes for CVE-2023-2455 and CVE-2016-2193 missed cases involving subqueries, WITH queries, and security invoker views.

CPAN.pm before version 2.35 does not verify TLS certificates when downloading distributions over HTTPS. This allows man-in-the-middle attackers to replace downloaded packages with malicious ones.

The pip package before version 19.2 for Python is vulnerable to directory traversal when a URL is provided in an install command. An attacker can exploit a Content-Disposition header containing '../' in the filename to overwrite files, such as /root/.ssh/authorized_keys.

NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify adbe.pkcs7.sha1 signatures on documents, allowing potential signature forgeries.