A missing authorization vulnerability exists in Apache ActiveMQ Broker and related distributions, allowing a different connection to consume messages from another connection's temporary destination. This breaks the expected isolation of temporary destinations. The issue affects versions before 5.19.8 and from 6.0.0 before 6.2.7. Upgrading to version 6.2.7 resolves the vulnerability.
LinuxCNC versions before 2.9.9 contain a local privilege escalation vulnerability in the rtapi_app component of linuxcnc-uspace. The vulnerable binary is installed with SUID root and loads shared libraries using a user-supplied module name without sufficient validation. This allows a local attacker to perform path traversal and load arbitrary shared libraries with root privileges, resulting in privilege escalation.
A vulnerability in the golang x image package's webp decoder can cause a panic when processing a VP8 chunk whose dimensions do not match the canvas size. This issue affects multiple specific versions of the golang-golang-x-image package. The vulnerability has a CVSS score of 7.5, indicating a medium severity impact primarily affecting availability due to potential denial of service via application crash.
Guzzle versions prior to 7.12.1 can transmit traffic expected to be protected by TLS to an HTTPS proxy in cleartext when used with libcurl versions older than 7.50.2. This occurs because older libcurl versions treat an https:// proxy as a plaintext http:// proxy, resulting in no TLS connection to the proxy. Consequently, proxy authentication credentials and the CONNECT target host and port for tunneled HTTPS requests are exposed in cleartext. This vulnerability is fixed in Guzzle 7.12.1.
Guzzle versions prior to 7.12.1 contain a vulnerability in the CookieJar component where cookies with a dot-only Domain attribute or whitespace-padded variants are incorrectly accepted. This flaw allows an attacker-controlled origin to set cookies that Guzzle may send to unrelated hosts sharing the same cookie jar, potentially enabling cookie injection or session fixation attacks. The issue is fixed in version 7.12.1.
Pypdf2 versions prior to 6.12.2 contain a vulnerability where an attacker can craft a specially designed PDF that causes long runtimes during processing. This issue arises when accessing a stream using the /FlateDecode filter with a PNG predictor. The vulnerability has a medium severity score and does not impact confidentiality or integrity but affects availability by causing performance degradation. It is fixed in version 6.12.2.
phpseclib versions from 0.1.1 up to but not including 1.0.30, 2.0.55, and 3.0.54 contain a server-side request forgery (SSRF) vulnerability. The X509::validateSignature() function reads a URL from the Authority Information Access extension of an untrusted X.509 certificate and connects to it by default, allowing an attacker to control the destination of the connection. This can lead to unauthorized internal network access. The vulnerability is fixed in versions 1.0.30, 2.0.55, and 3.0.54.
A Cross-Site Scripting (XSS) vulnerability exists in Angular's @angular/platform-server DOM emulation prior to versions 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25. The issue arises from improper serialization of <noscript> elements during Server-Side Rendering (SSR), allowing injected scripts to execute in the user's browser context. This vulnerability is fixed in the stated versions.
Python aiohttp versions prior to 3.14.1 have no limit on the number of pipelined HTTP requests that can be queued. This lack of limit allows an attacker to potentially consume excessive memory, leading to a denial of service (DoS). The issue is resolved in version 3.14.1.
Python aiohttp versions prior to 3.14.1 contain a vulnerability where an attacker can send large incomplete websocket frame payloads to bypass usual memory size limits. This can lead to excessive memory consumption causing denial of service. The issue is fixed in version 3.14.1.
Python aiohttp versions prior to 3.14.1 contain a vulnerability where the server_hostname TLS SNI check can be bypassed when an existing connection is reused. This allows later requests with different server_hostname parameters to reuse a TLS connection that should have been rejected. The issue is fixed in version 3.14.1.
A vulnerability in python-aiohttp prior to version 3.14.1 allows DigestAuthMiddleware to send an authentication response after following a cross-origin redirect. This behavior could be exploited if an attacker leverages an open redirect on the target domain. The attacker would only receive the digest authentication response, limiting credential exposure unless cryptography is weak or passwords are reused. The issue is fixed in version 3.14.1.
Python aiohttp versions prior to 3.14.1 contain a vulnerability in the C HTTP parser that allows bypassing the max_line_size check. This can enable an attacker to send oversized HTTP request lines, potentially causing excessive memory consumption and denial of service. The issue is fixed in version 3.14.1.
A vulnerability in python-aiohttp prior to version 3.14.1 allows a compressed request body to be decompressed into memory in one chunk during cleanup. This can potentially lead to a denial-of-service (DoS) condition, such as a zip bomb edge case. The issue is fixed in version 3.14.1.
Python aiohttp versions prior to 3.14.1 have a vulnerability where host-only cookies saved with CookieJar.save() lose their host-only status when restored with CookieJar.load(). This issue is fixed in version 3.14.1.
The Angular Language Service VS Code Extension prior to version 21.2.4 reads custom TypeScript SDK paths from workspace configurations without verifying VS Code Workspace Trust or user consent. This allows a malicious repository to cause the extension to load and execute a malicious tsserverlibrary.js script silently when the repository is opened in VS Code. The vulnerability is fixed in version 21.2.4.
The Angular Language Service VS Code Extension had a vulnerability where it trusted rendered Markdown content in tooltips without properly sanitizing JSDoc strings. This allowed attackers to embed malicious command links in JSDoc comments that, when hovered over and clicked by a developer, could execute commands on the developer's machine. This issue was fixed in version 21.2.4.
libexpat versions before 2.8.2 contain an integer overflow vulnerability in the storeAtts function. This flaw can cause the library to crash, resulting in a denial of service. The vulnerability affects multiple Ubuntu package versions across various LTS releases. A fix is available from Ubuntu, including updates distributed via Ubuntu Pro and Legacy Support add-ons.
An integer overflow vulnerability exists in libexpat before version 2.8.2, specifically in the getAttributeId function. This flaw can cause the library to crash, resulting in a denial of service. The issue affects multiple Ubuntu package versions and releases. Fixes are available through official Ubuntu security updates.
libexpat versions before 2.8.2 contain an integer overflow vulnerability in the XML_ParseBuffer function due to a missing check present in XML_Parse. This flaw could be exploited to cause denial of service or potentially execute arbitrary code. The issue affects multiple Ubuntu package versions of libexpat. Fixes are available through official Ubuntu security updates.