FrankenPHP versions before 1.13.4 have an information disclosure vulnerability in worker mode. The vulnerability arises because HTTP stream response headers are not cleared between requests, allowing subsequent requests on the same worker thread to access headers from previous requests. This can expose sensitive headers such as Set-Cookie or tokens from backend APIs to other users.
CESNET ipfixcol2 versions 2.7.1 up to but not including 2.9.0 contain a memory allocation vulnerability in the Lz4Decoder::read_start_header() function. This flaw allows unauthenticated attackers to exhaust server memory by sending TCP connections with LZ4 start headers that declare very large ring buffer sizes, potentially forcing allocations up to 4 GiB per connection. The vulnerability can lead to denial of service by exhausting collector service resources.
IBM MQ versions 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD contain a vulnerability where an authenticated attacker could cause denial of service or potentially execute arbitrary code. This is due to an integer overflow triggered by processing subscription requests with crafted buffer size values.
A code injection vulnerability exists in NPC-Worldwide npcpy versions up to 2.1.27 in the load_sft_model function due to unsafe handling of the base_model_name_or_path argument. This vulnerability can be exploited remotely and has publicly disclosed exploit code. The CVSS score is 6.3, indicating medium severity.
A critical path traversal vulnerability exists in the Comfast CF-WR632AX version 2.6.0.1 within the Multipart Parser component of the /usr/bin/webmgnt file. This vulnerability allows remote attackers to manipulate the filename argument to traverse directories. Exploit code is publicly available, and the vendor has not responded to disclosure attempts.
Joi versions 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contain a prototype pollution vulnerability in the lib/messages.js file. The vulnerability arises because the compile() and merge() functions fail to reject a __proto__ language key. This allows attackers to supply untrusted message configurations that can replace the compiled messages prototype, potentially altering or breaking validation error rendering and any dependent logic.
IBM MQ versions 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD contain a vulnerability that allows an authenticated attacker to execute arbitrary code on a Managed File Transfer agent host due to improper validation of metadata during script execution.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain an open redirect vulnerability that could allow a remote authenticated attacker to conduct a phishing attack. The vulnerability requires authentication and user interaction to exploit. The CVSS score is low, indicating limited impact primarily on confidentiality.
CESNET ipfixcol2 versions 2.3.0 up to but not including 2.9.0 contain an integer overflow vulnerability in the Forwarder output plugin. This flaw allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping 16-bit message length counters. Attackers can send large data sets and templates to a collector forwarding over TCP, causing crashes and potentially writing 2-byte values to attacker-controlled memory addresses.
A server-side request forgery (SSRF) vulnerability exists in DataLinkDC Dinky up to version 1.2.5 in the FlinkWebURITemplateProxyServlet.getNewTargetUri function. This flaw allows remote attackers to manipulate the _authority argument, potentially causing the server to make unintended requests. Exploit code has been published, indicating the vulnerability is exploitable. The issue was reported via a GitHub Security Advisory (GHSA).
Mistral Vibe versions before 2.25.5 on Windows are affected by an untrusted search path vulnerability. This flaw allows attackers to execute arbitrary code by placing a malicious git.exe file in a repository root. When a user opens a crafted repository, components SessionLogger and ProjectContextProvider run the malicious git.exe at session start before any trust prompt appears. The vulnerability has a high severity with a CVSS score of 8.8.
CESNET ipfixcol2 versions 2.7.1 up to but not including 2.9.0 contain a heap-based buffer overflow vulnerability in the Lz4Decoder.cpp component. This flaw allows unauthenticated network peers to write beyond heap buffer boundaries by manipulating buffer size parameters, potentially crashing the collector service. The vulnerability has a high severity score of 7.5 and impacts availability without affecting confidentiality or integrity.
Netrek-client-cow versions through 3.3.3 have an out-of-bounds read vulnerability in the short.c handleSMessage() function. This flaw allows malicious Netrek servers or attackers intercepting the TCP connection to send crafted SP_S_MESSAGE packets with an m_recpt index of 36 or higher, causing the client to read beyond the bounds of internal arrays. This results in a denial of service by crashing the client application.
A heap buffer overflow vulnerability exists in the reSIProcate reTurn client through version 1.14.0 in the TurnTcpSocket::handleReadHeader() function. This flaw allows malicious TURN servers to send STUN or ChannelData frames with oversized declared lengths, causing memory overwrite beyond the fixed buffer size and leading to client crashes.
netrek-client-cow versions through 3.3.3 have a stack-based buffer overflow vulnerability in the handleSMessage() function within short.c. This flaw allows malicious Netrek servers or man-in-the-middle attackers on the plaintext TCP connection to send oversized SP_S_MESSAGE packets that overflow a 100-byte stack buffer, potentially crashing the client application.
go-chi chi versions 5.2.2 through 5.5.0 contain an open redirect vulnerability in the RedirectSlashes middleware. This flaw allows attackers to craft URLs with embedded tab characters that bypass existing fixes and redirect users to external hosts. The vulnerability exploits how browsers handle URL-encoded tabs in the 301 Location header, enabling protocol-relative URL redirection.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability that allows a remote authenticated attacker to bypass security restrictions. This issue arises from improper restriction of rendered UI layers or frames, potentially enabling unauthorized access to certain interface elements or functions. The vulnerability has a medium severity rating with a CVSS score of 4.6.
vtenext versions before 25.02.1 contain an authentication bypass vulnerability that allows unauthenticated attackers to change any account password without token verification. By exploiting the hub/rpwd.php endpoint with a known valid user_name, attackers can invoke a password change action and gain administrator access if two-factor authentication is not enabled.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability that allows a remote authenticated attacker to cause a denial of service by exploiting improper validation of user-influenced resource identifiers. The vulnerability does not impact confidentiality or integrity but affects availability.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability where a remote authenticated attacker could obtain sensitive information due to a missing required cryptographic step. The vulnerability has a medium severity with a CVSS score of 4.3. No patch or remediation information is currently provided.