CVE Vulnerability Catalog

Spring Data Relational does not properly escape binding values for externally-controlled input when using StringMatcher (STARTING, ENDING, CONTAINING) in Query By Example (QBE). An attacker can use wildcard characters for data inference. Affects many versions of Spring Data Relational/JDBC/R2DBC.

Spring Data MongoDB improperly validates regex parameters in @Query annotated repository methods. An attacker can supply a crafted string to bypass intended regular expression quoting.

Vulnerability in Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a malicious authorization request with an invalid request_uri and an arbitrary, unvalidated redirect_uri, leading to an Open Redirect vulnerability. Affects Spring Security 7.0.0-7.0.5 and Spring Authorization Server 1.5.0-1.5.7.

An XXE vulnerability in Spring REST Docs when using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API over HTTP. An attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE attack when documentation-generating tests are next executed.

An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.

An authorized user can trigger a server crash by running a query with a 2dsphere index on a field storing a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS. The guard does not inspect GeometryCollection members, leading to a null-pointer dereference.

The ldapQueryPassword parameter, when set through the runtime setParameter command, is logged to the mongod.log file in plain text.

An authenticated MongoDB user can crash the server or return incorrect results by creating documents that interfere with internal metadata processing during query execution. This stems from insufficient separation between user-controlled fields and internal metadata.

When running an aggregation pipeline using the internal $exchange stage with key-range partitioning and order-preserving delivery, if a single key range produces enough documents to fill its exchange buffer, the server reaches a code path where a full per-consumer buffer is detected but the internal high watermark for that key range is not updated as intended.

In MongoDB, the $_internalConvertBucketIndexStats stage uses PauseExecution as a signal to skip a document, but PauseExecution is only intended for coordinating sub-pipelines in $facet. When this stage is placed before $facet, TeeBuffer receives an unexpected signal and violates an assertion, crashing mongod.

Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash the MongoDB server.

Using $changestreams and $_requestReshardingResumeToken with the exchange option causes an invariant violation, leading to a server crash. No special privileges are needed, but the user must be logged in.

In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines. If a getMore is subsequently issued on the same cursor, the server may dereference this null sub-pipeline when reattaching to the operation context, accessing an invalid address and crashing the process. This issue allows an authenticated user who can run aggregation pipelines to cause a denial of service by issuing a specially crafted aggregation followed by getMore on affected versions.

A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for encrypted fields within the $vectorSearch stage filter expressions being sent to the server as plaintext instead of ciphertext.

The MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, full authentication parameters are written without redaction.

In lldpd (IEEE 802.1ab LLDP implementation) before version 1.0.22, the lldpd_decode() function incorrectly calculates the shift size when stripping VLAN tags, leading to a heap buffer over-read. Fixed in version 1.0.22.

CAI Content Credentials libraries ([email protected], c2pa-v0.80.1 and earlier) are vulnerable to uncontrolled resource consumption. An attacker can exhaust system resources, causing application denial of service without user interaction.

Uncontrolled resource consumption vulnerability in CAI Content Credentials library ([email protected], c2pa-v0.80.1 and earlier). An attacker can exhaust system resources, causing a denial of service (DoS). Exploitation does not require user interaction.

Improper input validation vulnerability in CAI Content Credentials library ([email protected], c2pa-v0.80.1 and earlier). An attacker can crash the application, leading to a denial of service (DoS). Exploitation does not require user interaction.

Uncontrolled resource consumption vulnerability in CAI Content Credentials library ([email protected], c2pa-v0.80.1 and earlier). An attacker can exhaust system resources, causing a denial of service (DoS). Exploitation does not require user interaction.