CVE Vulnerability Catalog

On Red Hat Enterprise Linux systems with xdg-user-dirs before 0.15.5, the system umask policy is not honored when creating XDG user directories because Xsession sources xdg-user-dirs.sh before setting umask. This may lead to incorrect directory permissions.

runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or directories in arbitrary locations in the host filesystem by sharing a volume between two containers and exploiting certain operations.

Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry traces.

In the Linux kernel, a vulnerability in KVM for AMD SEV-SNP was found. During SNP launch finish, the synchronization and encryption of VMSA (Virtual Machine Save Area) does not lock all vCPUs, allowing userspace to manipulate or run a vCPU while its state is being synchronized.

In GNU C Library versions 2.27 to 2.38, an untrusted LD_LIBRARY_PATH environment variable vulnerability allows attacker-controlled loading of dynamically shared libraries in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions).

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to the ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.

Loofah::HTML5::Scrub.allowed_uri? does not correctly reject javascript: or vbscript: URIs when the scheme is split by a numeric character reference that has no trailing semicolon. A browser decodes such references and resolves the URL to an executable javascript: scheme, while allowed_uri? considers it safe.

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI with catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from log messages by manipulating the log message.

In PHP from 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, 8.4.* before 8.4.5, when requesting an HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect.

In PHP from 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, 8.4.* before 8.4.5, when receiving headers from an HTTP server, headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.

In PHP from 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, 8.4.* before 8.4.5, when user-supplied headers are sent, insufficient validation of end-of-line characters may prevent certain headers from being sent or lead to certain headers being misinterpreted.

Setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in PackageIndex is present in setuptools prior to version 78.1.1. An attacker can write files to arbitrary locations on the filesystem.

Vim is an improved version of the Unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. This may lead to the tb_off position within the buffer being out of bounds.

Faulty input validation in the core of Apache HTTP Server through 2.4.58 allows malicious or exploitable backend/content generators to split HTTP responses, leading to HTTP response splitting attacks.

HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack.

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests.

Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerable to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.

Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URLs to be handled by mod_proxy.

A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content.