CVE Vulnerability Catalog

In CPython's 'http.cookies' module, parsing cookies with backslash-escaped characters uses a quadratic algorithm, causing excessive CPU usage.

Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerable to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.

Setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in PackageIndex is present in setuptools prior to version 78.1.1. An attacker can write files to arbitrary locations on the filesystem.

Vim is an improved version of the Unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. This may lead to the tb_off position within the buffer being out of bounds.

Logic error in PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8. Filtering functions like filter_var when validating URLs (FILTER_VALIDATE_URL) for certain URL types return invalid user information (username+password part of URLs).

Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests.

GNU Midnight Commander 4.8.29-146-g299d9a2fb was found to contain a NULL pointer dereference in the function x_error_handler() at tty/x11conn.c. NOTE: this is disputed because it should be categorized as a usability problem (an X operation silently fails).

Multiple security vulnerabilities have been identified in the grpc-go library affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation. These vulnerabilities could lead to authorization bypass (Fail-Open) during rule translation.

Parsing error in multipart/form-data in PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12. Erroneous parsing can lead to legitimate data not being processed, and an attacker can control part of the submitted data.

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack.

A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow.

An integer overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when using the "-ImgDir" command line option on a directory containing 1048576 files.

An issue was discovered in versions 6.0 before 6.0.5 and 5.2 before 5.2.14 in `django.middleware.cache.UpdateCacheMiddleware`, which erroneously caches requests where the `Vary` header contained an asterisk (`'*'`). This can lead to private data being stored and served.

A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg.

The go-ntlmssp package before version 0.1.1 contains a vulnerability that causes a slice out of bounds panic when processing a malicious NTLM challenge message. This can crash any Go process using `ntlmssp.Negotiator` as an HTTP transport.

Wykryto słabość w LibTIFF 4.7.0, która dotyczy funkcji main w pliku tiffcrop.c komponentu tiffcrop. Manipulacja tą funkcją może prowadzić do uszkodzenia pamięci.

A TSIG packet with name compression can crash DNS. Incorrect size calculations when a TSIG record contains compressed names lead to a large out-of-bounds write, causing a server crash.

A low-privilege authenticated Samba AD user can modify internal LDB special DNs via LDAP access, enabling a domain takeover.

On Red Hat Enterprise Linux systems with xdg-user-dirs before 0.15.5, the system umask policy is not honored when creating XDG user directories because Xsession sources xdg-user-dirs.sh before setting umask. This may lead to incorrect directory permissions.