CVE Vulnerability Catalog

Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. This affects multiple Spring Boot versions including 4.0.0–4.0.5, 3.5.0–3.5.13, 3.4.0–3.4.15, 3.3.0–3.3.18, and 2.7.0–2.7.32.

Vulnerability in aligungr UERANSIM up to version 3.2.7. The function rls::DecodeRlsMessage in the library src/lib/rls/rls_pdu.cpp of the Radio Link Simulation Layer component leads to an uncaught exception when manipulating the pduLength argument. The attack may be initiated remotely. Fixed in version 3.2.8.

A security vulnerability has been detected in OSPG binwalk up to 2.4.3. The function read_null_terminated_string in the file src/binwalk/plugins/winceextract.py of the WinCE Extraction Plugin is vulnerable to path traversal via manipulation of the argument self.file_name. The attack can only be performed from a local environment. The exploit has been disclosed publicly. The project maintainer confirms the issue but states the project has reached end-of-life (EOL) and recommends migration to binwalk v3.

When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. Affected versions: Spring Boot 4.0.0–4.0.5 (fixed in 4.0.6), 3.5.0–3.5.13 (fixed in 3.5.14).

A vulnerability was found in vLLM up to 0.19.0. The affected element is the function has_mamba_layers of the file vllm/v1/kv_cache_interface.py of the component KV Block Handler. Performing a manipulation results in uninitialized resource. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is described as difficult. The exploit has been made public and could be used. The existence of this vulnerability is still disputed at present. The proposed patch did not fix the issue. A 3rd party explains: "The divergence could be explained by a benign and expected vLLM behavior where vLLM server could group concurrent requests together resulting in different input shapes based on varying request arrival time. The differences in grouped input shapes could call different kernels with could produce difference results due to rounding and differences in order of operations. There is an environment variable VLLM_BATCH_INVARIANT=1 for users that desire to have deterministic output with temperature 0.0."

A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/selectindices.php via the namecontains parameter.

A reflected cross-site scripting (XSS) vulnerability exists in diskover-community version 2.3.5 and earlier. An attacker can inject malicious JavaScript code via the doctype parameter in public/view.php.

A path traversal vulnerability in the Blocks module of Daylight Studio FuelCMS v1.5.2 allows attackers to perform directory traversal operations.

SmarterTools SmarterMail w wersjach przed 9610 zawiera słabość kryptograficzną w punktach końcowych udostępniania plików i e-maili, wykorzystującą szyfrowanie DES-CBC z kluczami i wektorami inicjalizacyjnymi pochodzącymi z System.Random, co prowadzi do ograniczonej przestrzeni nasion do około 19 000 możliwych wartości. Atakujący bez uwierzytelnienia może wykorzystać punkt końcowy pobierania załączników jako oracle do określenia używanego nasienia i wyprowadzenia kluczy szyfrujących oraz wektorów inicjalizacyjnych, co pozwala na fałszowanie tokenów udostępniania dla dowolnych e-maili, załączników lub zawartości przechowywanych plików bez wcześniejszego dostępu do docelowej zawartości.

Authenticated user can bypass authorization in Ribblr - Crochet & Knitting iOS application

W jądrze systemu Linux zidentyfikowano podatność związaną z walidacją zagnieżdżonych nagłówków VLAN w funkcji tcf_csum_act(). Błąd polega na tym, że kod nie sprawdza, czy pełny nagłówek VLAN jest dostępny w liniowym obszarze przed jego odczytem, co może prowadzić do naruszenia zasad integralności skb.

W jądrze systemu Linux zidentyfikowano podatność w module netfilter, która dotyczy walidacji kodowania zakresu w funkcji checkentry. Funkcja ports_match_v1() błędnie traktuje niezerowe wpisy pflags jako początek zakresu portów, co może prowadzić do nieprawidłowej interpretacji reguł.

In LangChain before version 1.1.2, an SSRF vulnerability exists in HTMLHeaderTextSplitter.split_text_from_url(). Although the initial URL is validated, redirects are not checked, allowing an attacker to access internal network resources.

CyberPanel versions prior to 2.4.5 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to inject malicious JavaScript by overwriting the findings_json field of ScanHistory records. Attackers can inject JavaScript that executes in an administrator's authenticated session when they visit the AI Scanner dashboard, allowing them to issue same-origin requests to plant cron jobs and achieve remote code execution on the server.

Axios versions 1.0.0 through 1.15.1 are vulnerable to a Prototype Pollution Gadget attack, allowing modification of JSON API responses, including privilege escalation and data manipulation.

A vulnerability in Axios before versions 1.15.1 and 0.31.1 allows a Prototype Pollution attack that causes all HTTP responses (including errors 401, 403, 500) to be treated as success. Authentication and error handling are bypassed.

A vulnerability in the rust-openssl library (versions 0.9.24 through 0.10.78) causes the PSK and cookie callbacks to not validate the user closure's return value against the buffer size. This can lead to buffer overflows and other unintended consequences.

A client-side authorization flaw in Lightspeed Systems Classroom v5.2.1.1763770643 allows unauthenticated attackers to impersonate users by bypassing integrity checks and abusing client-generated authorization tokens, leading to unauthorized control and monitoring of student devices.

An information leak was discovered in the build_report() function in the xfrm_user subsystem of the Linux kernel. The xfrm_user_report structure contains unzeroed padding bytes that are copied to userspace, potentially exposing kernel memory.

A vulnerability in the Linux kernel's rfkill mechanism allows userspace to create an unlimited number of rfkill events without consuming them from the file descriptor, potentially leading to an out-of-memory condition.