CVE Vulnerability Catalog

ESP-IDF (Espressif IoT Development Framework) has an out-of-bounds read vulnerability in the DHCP server option parser in the lwIP component. A crafted DHCP request can cause reads past the buffer into adjacent heap memory.

Frappe Learning Management System (LMS) prior to version 2.53.0 allows an authenticated user to supply specially crafted content in certain user-editable fields. When surfaced in page metadata, this causes visitors' browsers to navigate to an attacker-chosen URL.

BuddyPress 14.4.0 has an IDOR vulnerability in the friends REST API allowing an authenticated attacker to enumerate any user's complete friend list. The get_items_permissions_check method only checks if the requester is logged in, not ownership.

The SubjectDnX509PrincipalExtractor in Spring Security does not correctly handle certain malformed X.509 certificate CN values, potentially reading the wrong username. A crafted certificate could allow an attacker to impersonate another user. Affected versions: 5.7.0-5.7.24, 5.8.0-5.8.26, 6.3.0-6.3.17, 6.4.0-6.4.17, 6.5.0-6.5.10.

In Nimiq prior to version 1.5.0, a remote peer can crash any full node by sending a RequestBatchSet message containing the genesis block's hash. The handler calls get_epoch_chunks which iterates backwards through macro blocks and panics when reaching the genesis block number.

In Nimiq (Rust implementation of Nimiq Proof-of-Stake protocol) before version 1.4.0, a denial-of-service vulnerability exists in the Ed25519 multisig delinearization code. An invalid public key can cause a panic and crash the process. Fixed in version 1.4.0.

Nimiq (Rust implementation) prior to version 1.4.0 has a bug in LightBlockchain::rebranch() – when switching to a chain with a macro block, it does not update macro_head, election_head, or current_validators. This causes incorrect verification of subsequent blocks and stalls the light client's chain progression.

In Nimiq before version 1.4.0, a logic flaw in BlockInclusionProof::is_block_proven causes it to return true without cryptographic verification when the hop list is empty. An attacker can forge a MacroBlock header for a specific epoch position and have it accepted as proven.

FlashMQ before version 1.26.2 allows authorized clients to exceed the permitted over-commit of their write buffer, triggering an internal safe-guard exception. This exception is in a path that cannot be caught, causing a server abort.

Nimiq before version 1.4.0 has a vulnerability in DHT GET query handling in the network-libp2p component. When a peer returns a found record and DHT verification fails, handle_dht_get returns without completing the oneshot and without cleaning up query state, causing Network::dht_get to hang indefinitely.

Spring Data REST's Querydsl integration accepts arbitrary property paths as filter keys and ignores Jackson customizations before handing them to Querydsl. Affects versions 3.7.0-3.7.19, 4.3.0-4.3.16, 4.4.0-4.4.14, 4.5.0-4.5.11, 5.0.0-5.0.5.

Vulnerability in Spring Data REST where the full exception cause chain is serialized into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affects versions 3.7.0-3.7.19, 4.3.0-4.3.16, 4.4.0-4.4.14, 4.5.0-4.5.11, 5.0.0-5.0.5.

Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify where the message was in the retry sequence.

Spring for Apache Kafka versions 4.0.0-4.0.5, 3.3.0-3.3.15, 3.2.0-3.2.13, 2.9.0-2.9.13, and 2.8.0-2.8.11 allow a producer to grow the consumer's heap without bound by sending records with unique spring.kafka.serialization.selector header values, leading to GC thrash and OutOfMemoryError.

Spring Data Commons has a vulnerability that can lead to a Denial of Service (DoS) when Spring Data Web Support is enabled with a Controller method using @ProjectedPayload. An attacker can send a crafted HTTP request causing excessive memory allocation.

A SpEL Injection vulnerability in Spring Data KeyValue occurs when unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. An attacker can remotely execute arbitrary code.

In Spring AMQP, applications configuring broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.

Applications using Spring Data Commons may be vulnerable to a DoS attack leading to a StackOverflowException when parsing Sort parameters. Affected versions range from 2.7.0 to 4.0.5.

A vulnerability in Spring Security's CookieRequestCache and CookieServerRequestCache stores the full absolute pre-authentication URL in a browser cookie. After login, the user is redirected to this URL without validation, enabling an open redirect attack.

Vulnerability in Spring AMQP causes correlation IDs for replies in RabbitTemplate.sendAndReceive() with fixed reply queue to be predictable due to an internal simple counter. Affects Spring AMQP versions 4.0.0-4.0.3, 3.2.0-3.2.10, 3.1.0-3.1.15, and 2.4.0-2.4.17.