Threat database

CVE-2024-25641 is a critical arbitrary file write vulnerability in Cacti versions prior to 1.2.27. It affects the "Package Import" feature, allowing authenticated users with "Import Templates" permission to write or overwrite files on the web server via path traversal in the import_package() function. This can lead to arbitrary PHP code execution. The issue is fixed in version 1.2.27.

CVE-2024-27280 is a critical buffer-overread vulnerability in the StringIO library versions 3.0.1 as used in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The flaw allows the ungetbyte and ungetc methods to read beyond the end of the string buffer, potentially exposing memory contents when StringIO.gets is called subsequently. Fixed versions include 3.0.3, stringio 3.0.1.1 for Ruby 3.0, and stringio 3.0.1.2 for Ruby 3.1.

Jinja2 versions prior to 3.1.4 have a vulnerability in the xmlattr filter where user input passed as keys can include characters that lead to HTML attribute injection. This can allow an attacker to inject additional attributes and potentially perform cross-site scripting (XSS) if the application renders these keys in pages viewed by other users. The issue arises because xmlattr does not restrict keys from containing characters like spaces, '/', '>', or '=', which are invalid in XML/HTML attributes. The vulnerability is fixed in version 3.1.4.

CVE-2024-22391 is a heap-based buffer overflow vulnerability in the LookupTable::SetLUT function of Grassroot DICOM version 3.0.23. This flaw allows an attacker to cause memory corruption by providing a specially crafted malformed file. The vulnerability has a high severity score of 7.7 and can impact confidentiality, integrity, and availability.

CVE-2024-25569 is an out-of-bounds read vulnerability in the RAWCodec::DecodeBytes function of Grassroot DICOM version 3.0.23. This flaw can be triggered by processing a specially crafted DICOM file, potentially leading to information disclosure or application instability.

CVE-2024-22025 is a vulnerability in Node.js affecting multiple versions where the fetch() function always decodes Brotli compression. This behavior can be exploited by an attacker controlling the URL passed to fetch() to cause resource exhaustion, leading to a Denial of Service (DoS) condition. The attack results in memory exhaustion that may terminate the Node.js process depending on system configuration.

CVE-2024-22019 is a high-severity vulnerability in Node.js HTTP servers where specially crafted HTTP requests with chunked encoding can cause resource exhaustion. The flaw arises because the server reads an unlimited number of bytes from a single connection due to missing limits on chunk extension bytes. This can lead to denial of service by exhausting CPU and network bandwidth, bypassing typical protections like timeouts and body size limits.

Jinja2 versions prior to 3.1.3 have a vulnerability in the xmlattr filter that allows HTML attribute injection when user input is passed as keys. This occurs because keys containing spaces are accepted, which can be interpreted as multiple attributes, enabling potential cross-site scripting (XSS) if untrusted keys are rendered. This issue is mitigated by verifying keys or upgrading to version 3.1.3 or later.

CVE-2024-21647 is a vulnerability in Puma HTTP server versions prior to 6.4.2 and 5.6.8 where improper parsing of chunked transfer encoding bodies allows unbounded resource consumption. This occurs because chunk extensions are not size-limited, enabling attackers to exhaust CPU and network bandwidth resources. The issue has been fixed in versions 6.4.2 and 5.6.8. No known workarounds exist.

A StackOverflow vulnerability (CVE-2024-21634) exists in the ion-java library versions prior to 1.10.5. This flaw can cause a denial-of-service condition when deserializing crafted Ion text or binary data or when invoking certain IonValue methods on the deserialized data. The issue is fixed in ion-java version 1.10.5.