CVE Vulnerability Catalog

In Apache HTTP Server's mod_http2 from 2.4.0 through 2.4.68, a Use After Free vulnerability exists via shared session->bbtmp re-entrancy.

An out-of-bounds write vulnerability in Apache HTTP Server's mod_proxy_html occurs when processing crafted HTTP response bodies. The issue affects version 2.4.68.

In Apache HTTP Server's mod_rewrite from 2.4.0 through 2.4.68, a Use After Free vulnerability exists when using lookahead (%{LA-U:HTTP:...}).

In Apache HTTP Server's mod_charset_lite from 2.4.0 through 2.4.68, an out-of-bounds write vulnerability exists.

In mod_auth_digest of Apache HTTP Server before 2.4.69, missing authentication checks allow an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck.

HCL AION is affected by a vulnerability in which the Content-Security-Policy (CSP) HTTP response header is not configured. CSP helps prevent attacks such as Cross-Site Scripting (XSS) by restricting the sources from which scripts, styles, and other resources can be loaded. The absence of this header may reduce the effectiveness of browser-based security controls, potentially resulting in unintended behavior or negative security impacts under certain conditions.

In the revoked-key error path, a human-readable failure reason is built using sprintf() into a heap buffer, but the allocated buffer is too small for the final formatted message, which can lead to a write past the end of the heap allocation.

The Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products does not properly enforce authentication. A local, authenticated attacker can bypass the driver's access-control handshake and issue arbitrary privileged commands to the driver, resulting in disclosure of kernel and process memory.

A flaw was found in Foreman's foreman-rake initialization logic in /usr/share/foreman/config/settings.rb, where configuration data is processed through two distinct executable layers. This enables Server-Side Template Injection (SSTI) and insecure deserialization, potentially leading to remote code execution.

OS command injection vulnerabilities exist in Foreman's foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call.

A command injection vulnerability exists in Foreman's foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization.

The Red Hat Satellite /unattended/provision API endpoint in Foreman is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request.

A command injection vulnerability exists in rubygem-foreman_remote_execution's Red Hat Satellite API (/api/v2/job_invocations). When a job template has the effective_user property marked as overridable: true, the application fails to properly sanitize the effective_user input provided during the API request.

Prior to version 1.1.35, GraphQL Tools' executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loader with SubscriptionProtocol.LEGACY_WS, can accept an attacker-controlled certificate.

The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by injecting an unescaped site_title value in a package's footprint.json file. Attackers can place a crafted package under the prime-mover-export-files directory so that the malicious value renders unescaped in the column_site_title() method of PrimeMoverBackupMenuListTable.php, triggering script execution in an administrator's browser when they view the Prime Mover Packages list table without needing to restore the package.

The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated administrators to delete arbitrary directories by importing a crafted WPRIME/TAR package with manipulated tar_root_folder values in wprime-config.json. Attackers can exploit insufficient path validation in computeExtractVariables() and validateImportedSiteVsPackage() to cause primeMoverDoDelete() to remove directories outside the intended extraction path, potentially deleting critical WordPress directories such as wp-admin and rendering the site inoperable.

The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences processed by computeExtractionParameters() and resumableZipExtractor().

HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to inject unvalidated, malformed data into the application, enabling potential injection attacks or errors in downstream processing systems.

Fortra BoKS Server Agent contains a predictable password generation vulnerability in the adjoin utility. Machine-account passwords generated during Active Directory join or password renewal operations may have significantly less entropy than intended, making them more susceptible to prediction by an attacker who can estimate when the password was generated.

Classroom 50 prior to version 1.11.0, when running `gh teacher download`, clones each student's assignment repository and then writes autograde artifacts (`result.json` and `results.json`) into the just-cloned working tree. The write followed symlinks, so a student who committed `result.json` or `results.json` as a symlink could redirect the teacher's write to an arbitrary path (e.g. `~/.zshrc`, `~/.ssh/authorized_keys`, a cron file, or an in-clone `.git/hooks/*` file), with attacker-controlled bytes. This is an arbitrary file write leading to code execution as the teacher, whose `gh` token carries `admin:org`, `repo`, and `workflow` across the entire classroom organization.