CVE Vulnerability Catalog

libcurl accidentally skips certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.

The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause excessive memory and CPU consumption while parsing YAML, as used by Docker Compose from versions v2.27.0 to v2.29.7.

An issue was discovered in py-lmdb 0.97 where for certain values of md_flags, mdb_node_add does not properly set up a memcpy destination, leading to an invalid write operation. This occurs when accessing a data.mdb file supplied by an attacker.

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the thread/process. This might be used to DoS.

libcurl supports pinning of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, but fails to specify that it does not for QUIC.

The vulnerability in IOMMU stems from improper input validation, allowing a malicious hypervisor to reconfigure IOMMU registers. This results in loss of guest data integrity.

An improper access control vulnerability in Secure Encrypted Virtualization (SEV) allows a privileged attacker to write to the reverse map page (RMP) during Secure Nested Paging (SNP) initialization, potentially leading to loss of guest memory confidentiality and integrity.

Missing checks in certain functions related to RMP initialization allow a local admin privileged attacker to cause misidentification of I/O memory, potentially resulting in a loss of guest memory integrity.

In the Linux kernel, a page fault occurs in the vfio/xe driver when resetting VF devices that do not support migration. The fix reorganizes initialization to decouple migration from reset.

The ORAS Go library can forward registry credentials configured for one origin to a different HTTP origin during registry redirects. This occurs when fetching manifests or metadata.

A vulnerability was found in the Linux kernel's KVM for AMD SEV. It fails to reject attempts to synchronize vCPU state with an already encrypted VMSA after the VM has been launched.

A logic error in the env utility of uutils coreutils causes incorrect parsing of command-line arguments when using the -S (split-string) option. Unlike GNU env, the uutils implementation mishandles backslashes within single quotes, leading to incompatibility.

In glibc 2.15, a bug was introduced in the nscd daemon that causes a null pointer dereference when a not-found netgroup response is not added to the cache. This leads to a crash of nscd.

A vulnerability in the Nodemailer library allows header injection via the `list.*.comment` field, which is not sanitized for CR (`\r`) and LF (`\n`) characters. An attacker can supply a malicious value in this field, leading to email header spoofing.

A vulnerability in Nodemailer allows bypassing the `disableFileAccess` and `disableUrlAccess` options when using `jsonTransport`. While the normal MIME streaming path enforces these restrictions, `jsonTransport` serializes the message in a way that bypasses them, potentially enabling access to local files or external URLs.

The html/template package in Go improperly handles HTML-like "" and hashbang "#!" comment tokens within <script> contexts. This can cause the template parser to misinterpret script contents, leading to improper escaping of actions.

The html/template package in Go improperly applies rules for handling "<script", "<!--", and "</script" sequences within JS literals in <script> contexts. This may cause the template parser to prematurely terminate script contexts, leading to improper escaping of actions.

When parsing a multipart form in Go, limits on the total form size were not applied to memory consumed while reading a single form line. This allows an attacker to send a malicious request causing excessive memory consumption.

A vulnerability in Go's crypto/tls library causes a panic when verifying a certificate chain containing a certificate with an unknown public key algorithm. This affects all TLS clients and servers with client certificate verification enabled.

The vulnerability in the os.OpenFile implementation in Go causes different behavior on Unix and Windows systems when the target path is a dangling symlink. On Unix, the O_EXCL flag prevents following symlinks, while on Windows the function may follow the symlink to a nonexistent location.