CVE Vulnerability Catalog

In OpenStack Swift before 2.36.2 and 2.37.2, the s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.

In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. The attacker embeds the exploit as an oversized geometry attribute in a crafted NetCDF file, achieving arbitrary code execution on the server running GDAL.

A vulnerability has been found in itsourcecode Courier Management System 1.0. Impacted is an unknown function of the file /manage_user.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

GNU libredwg up to version 0.13.4.8160 contains a heap-based buffer overflow in the bit_read_RC function of bits.c in the Dwgbmp Utility component, which can be exploited remotely.

GitHub Enterprise Server prior to version 3.22 has an SSRF vulnerability in an upload endpoint that allows an unauthenticated attacker to send crafted requests to internal services. By injecting path traversal content into request parameters, an attacker can bypass the intended request flow and redirect internal API calls.

A security vulnerability has been detected in code-projects Project Management System 1.0. Affected is an unknown function of the file chk.php of the component Login. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

The libgnutls library contains a short heap overread vulnerability during RSA key exchange using a PKCS#11 token. By sending a very short premaster secret, an attacker can cause information disclosure.

The epa4all-client library (Java Client for epa4all / ePA 3.0 in Telematik Infrastruktur) prior to version 1.2.2 does not properly validate TLS certificates. An attacker on the network path between the ePA service and the Konnektor can present any TLS certificate (self-signed, expired, wrong CN) and intercept all SOAP traffic, including patient identifiers (KVNR), SMC-B card operations, document content, and credential exchanges.

In Dozzle before version 10.5.2, in the default configuration (no DOZZLE_AUTH_PROVIDER set), the POST /api/notifications/test-webhook endpoint is accessible without authentication. An attacker can supply an arbitrary URL, and Dozzle will send an HTTP POST with controlled headers and return the response (status code and up to 1MB of body) to the attacker.

The smallbitvec library for Rust versions 1.0.1 through 2.6.0 has an integer overflow in internal capacity calculation, leading to undersized heap allocation and heap buffer overflow via safe APIs. This allows memory corruption without requiring unsafe code from the caller.

Velocity.js is a JavaScript implementation of the Apache Velocity template engine. In 2.1.5 and earlier, a prototype pollution vulnerability was discovered. This issue occurs during the processing of #set directives in Velocity templates. If an application renders a template controlled by an attacker, it is possible to modify Object.prototype, potentially leading to Denial of Service (DoS) or Remote Code Execution (RCE) depending on the server environment.

Vanetza in version 26.02 and earlier contains a denial-of-service vulnerability in the cryptographic verification pipeline. When processing incoming V2X messages, the ASN.1 decoder accepts the structure as syntactically valid but does not enforce semantic constraints. Later OER re-encoding detects the violation and raises an exception that is not caught, leading to immediate process termination.

In the epa4all-client Java client, the SignedPublicKeysTrustValidatorImpl.isTrusted() method discards the boolean return value of ECDSA signature verification, always returning true for any structurally valid signature.

Vanetza, an open-source implementation of the ETSI C-ITS protocol suite, in version 26.02 and earlier, has a denial-of-service vulnerability in the ASN.1/OER parsing pipeline. When processing malformed network packets with corrupted ASN.1/OER structures, the ASN.1 wrapper raises a std::runtime_error that is not caught, leading to std::terminate and process termination.

Flaw in gnutls certificate validation. An oversized Subject Alternative Name (SAN) can cause incorrect fallback to Common Name (CN) check, allowing a remote attacker to bypass certificate validation and perform spoofing or man-in-the-middle attacks.

A flaw in gnutls allows a remote attacker to present a specially crafted certificate with URI or SRV SANs, potentially causing incorrect hostname validation against CN and enabling service spoofing or data interception.

A race condition was addressed with additional validation in macOS Sequoia 15.7 and macOS Tahoe 26. An app may be able to gain root privileges.

A logic issue in macOS allows a malicious app to gain root privileges. The flaw is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, and macOS Tahoe 26.

Vulnerability in JeecgBoot up to version 3.9.1 in the LoginController.selectDepart function in /sys/selectDepart, due to improper access controls. The attack can be performed remotely.

An attacker is able to downgrade the security of a Bluetooth LE connection by deleting an existing bond, spoofing the bonded device and creating a new bond.