CVE Vulnerability Catalog

The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests and the server-side authorization token to an attacker-controlled endpoint.

PhpSpreadsheet in many versions is vulnerable to a DoS attack via OLE file reading. The OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles. A tiny malformed .xls file can cause the reader to repeatedly append the same sector data until PHP memory is exhausted.

PhpSpreadsheet in many versions is vulnerable to SSRF via bypass of the WEBSERVICE() domain whitelist. The webService() function validates the URL host against the whitelist, but PHP automatically follows HTTP 301/302 redirects and the redirect target is not re-validated. An attacker can upload an XLSX file that, when the WEBSERVICE() formula is calculated, causes access to arbitrary URLs, including internal addresses.

In the Python SDK pytonapi versions 2.0.0 to 2.2.0, TonapiWebhookDispatcher fails to validate the Authorization header when a webhook handler is registered with a custom path. An unauthenticated remote attacker can POST forged payloads to the custom webhook endpoint and trigger victim-defined handlers.

Adobe Photoshop Installer is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. An attacker can place a malicious library in a directory searched by the installer. Exploitation requires user interaction (running the installer).

Format Plugins is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction (opening a malicious file).

TinyWeb through version 0.0.8 has a path traversal vulnerability allowing unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path. The path is concatenated without normalization, dot-segment removal, or boundary checks. Attackers can expose sensitive files like credential stores and private keys when the server runs as root.

TinyWeb through version 0.0.8 has a null pointer dereference vulnerability allowing unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. HttpParser::execute() fails to allocate the Url object, and buildResponse() dereferences the NULL pointer without checking the valid_requ flag, causing SIGSEGV and permanent server shutdown after repeating on all workers.

TinyWeb through version 0.0.8 has a memory leak vulnerability allowing unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request allocates Url, HttpHeaders, and HttpHeader objects via raw new expressions that are never freed due to missing destructors and unreachable delete calls, causing worker memory to grow by ~20-28 kB per request until the process is killed.

Rouille versions 0.3.3 through 3.6.2 have an HTTP request smuggling vulnerability allowing remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into client-supplied header values. These values are copied verbatim to upstream connections without validation. Attackers can craft a header containing an additional HTTP request interpreted as separate by backends (e.g., Go net/http, Python http.server), bypassing Rouille's access control logic.

QTI Neon version 1.0.0 has a vulnerability in the relay's handleReconnectRequest function that forwards RECONNECT_REQUEST packets to the host without bounding them. An unauthenticated client can cause relay-to-host amplification, leading to denial of service (DoS) on the host. No fixed version is available.

A vulnerability in the OAuth Ruby library allows an attacker to capture the Authorization header during a redirect. The OAuth::Consumer client follows a 3xx redirect, which can mutate the configuration and expose sensitive data.

A vulnerability in the OAuth2 Ruby library allows the Authorization header to leak to an attacker-controlled host. A protocol-relative redirect overrides the request authority.

The gopacket library for Go version 1.6.0 and earlier has a vulnerability in the Diameter AVP decoder. An attacker can control the Length field in an AVP, causing an unsigned 32-bit underflow and allocation of about 4 GiB memory. Two such messages can cause OOM and denial of service.

The gopacket library for Go version 1.6.0 and earlier has a vulnerability in the sFlow ExtendedGatewayFlow decoder. An attacker controls 32-bit community and AS path member counts, leading to allocation of up to 16 GiB memory from a 104-byte UDP datagram, causing denial of service.

A vulnerability in sg3_utils (sg_inq command) allows injection of properties into the udev database. Control characters in SCSI names are not sanitized, enabling arbitrary command execution as root when the device is disconnected.

A vulnerability in Camaleon CMS allows an authenticated user with custom field management permissions to execute arbitrary Ruby code. A malicious expression in the select_eval field is evaluated via instance_eval when rendering the post edit page.

A vulnerability in Pterodactyl causes a global login rate limit affecting all users. The limit is global, not per IP, allowing an attacker to block login for everyone by sending about 10 requests per minute.

A vulnerability in Pterodactyl allows an authenticated subuser to write arbitrary files to the server without the required permissions. A JWT token issued for other operations (e.g., WebSocket) can be reused for file uploads.

A vulnerability in the wakaru JavaScript decompiler allows writing files outside the target directory. Filenames with traversal sequences (e.g., ....//) are sanitized only once, allowing escape from the output directory.