CVE Vulnerability Catalog

A vulnerability in the UEFI implementation within QEMU (or similar software) causes a heap overflow in the hardware module (hw/uefi). An attacker can exploit this flaw to gain unauthorized access or execute arbitrary code.

Insufficient granularity of access control in SEV firmware allows a privileged user with a malicious hypervisor to create a SEV-ES guest with an ASID meant for SEV-SNP guests, potentially leading to partial loss of confidentiality.

A vulnerability in the Nokogiri library affects the `Nokogiri::XML::NodeSet#[]` method (and its alias `#slice`). The index check against the node set's bounds used a 32-bit-truncated copy of the index, allowing a large negative index to pass the check and then be used at full width, reading outside the node set's storage.

A NULL pointer dereference vulnerability was found in the Linux kernel's ALSA driver for the TASCAM US-144MKII device. A malicious USB device can have a configuration with interface number 1 but missing interface 0, leading to a system crash.

An issue was discovered in py-lmdb 0.97 where for certain values of mn_flags, mdb_cursor_set triggers a memcpy with an invalid write operation within mdb_xcursor_init1. This occurs when accessing a data.mdb file supplied by an attacker.

A vulnerability in the axios library allows sending requests to absolute URLs instead of relative ones, potentially leading to SSRF attacks and credential leakage. Even with baseURL set, axios ignores it and sends the request to the specified absolute URL.

A vulnerability in the Go standard library (net/netip) causes IsPrivate, IsLoopback, and similar methods to mishandle IPv4-mapped IPv6 addresses, returning false for addresses that would return true in their traditional IPv4 forms.

In nodemailer v9.0.0, the message-level `raw` option bypasses `disableFileAccess` and `disableUrlAccess` protections, enabling arbitrary file reads and full SSRF (Server-Side Request Forgery) in the sent message.

The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories.

A vulnerability in Go's HTTP/2 implementation allows a malicious client to rapidly create and reset requests, causing excessive server resource consumption. Although the number of concurrent streams is limited by MaxConcurrentStreams, resetting requests enables the attacker to continuously send new requests.

The filepath package in Go does not recognize paths with a \??\ prefix as special. On Windows, a path starting with \??\ is equivalent to a path starting with \\?\ and can be used to access arbitrary system locations.

The Go HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. The fix prevents sending requests with invalid Request.Host or Request.URL.Host values.

A vulnerability in libfuse versions 3.18.0 through 3.18.1 causes a NULL pointer dereference and memory leak in the fuse_uring_init_queue function. A local user can exploit this to crash the FUSE daemon or exhaust system resources.

A vulnerability in the Go crypto/tls library allows a DoS attack by sending extremely large RSA keys in certificate chains, causing high CPU usage during signature verification. The fix restricts RSA key sizes transmitted during handshakes to a maximum of 8192 bits.

A vulnerability in the Go net/http library allows a malicious HTTP sender to use chunk extensions to force a receiver to read many more bytes from the network than are in the body. A malicious HTTP client can exploit this to cause a server to automatically read a large amount of data (up to about 1 GiB).

In the Linux kernel, a vulnerability was found in the mechanism preventing timer interrupt starvation. Missing resets of the next_event_forced flag in several places, such as when the clock event state changes, may cause incorrect behavior.

The IsLocal function on Windows incorrectly detects reserved device names in some cases. Reserved names followed by spaces (e.g., "COM1 ") and names "COM" and "LPT" with superscript 1, 2, or 3 are incorrectly reported as local. The fix ensures IsLocal now correctly identifies these.

A vulnerability in the Go standard library (net/http) causes the HTTP client to not forward sensitive headers like Authorization or Cookie when following a redirect to a domain that is not a subdomain or exact match of the original domain. For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to a different domain will not.

A vulnerability in Go's html/template package allows bypassing contextual auto-escaping if errors returned by MarshalJSON methods contain user-controlled data. This can lead to injection of unexpected content into HTML templates.

A vulnerability in the Go standard parser causes a panic when processing source code with deeply nested literals. The issue stems from stack exhaustion during recursive parsing.