BlueprintUE Self-Hosted Edition versions from 4.2.0 up to but not including 4.3.4 have a login rate limit bypass vulnerability. The flaw exists because the login middleware keys failed-login counters on case-sensitive usernames, while the underlying MySQL lookups are case-insensitive. This mismatch allows unauthenticated attackers to bypass per-account lockout by varying username casing and thus gain additional brute-force attempts.
Mistral Vibe versions before 2.25.7 have a remote code execution vulnerability. This flaw allows attackers to execute arbitrary commands by configuring malicious Git clean or process filter drivers in a repository. When a user opens such a crafted repository, the application runs git status at startup, triggering the malicious filters and executing commands with the user's privileges before any trust prompt appears.
WebVirtCloud contains a missing authorization vulnerability in certain API endpoints due to lack of permission declarations. This allows low-privileged authenticated users to access migration and instance creation functions without proper restrictions, potentially enabling unauthorized migration or undefinition of other users' virtual machines and creation of volumes and domains on any compute host.
jsondiffpatch versions before 0.7.7 have a cross-site scripting (XSS) vulnerability. This flaw allows attackers to inject malicious markup by providing an unescaped array-move destination index in a delta. If an attacker controls the delta passed to the formatters.html.format() or formatters.annotated.format() functions, they can embed scripts that execute in the context of the application's origin when the output is rendered.
FrankenPHP versions before 1.13.4 have an information disclosure vulnerability in worker mode. The vulnerability arises because HTTP stream response headers are not cleared between requests, allowing subsequent requests on the same worker thread to access headers from previous requests. This can expose sensitive headers such as Set-Cookie or tokens from backend APIs to other users.
CESNET ipfixcol2 versions 2.7.1 up to but not including 2.9.0 contain a memory allocation vulnerability in the Lz4Decoder::read_start_header() function. This flaw allows unauthenticated attackers to exhaust server memory by sending TCP connections with LZ4 start headers that declare very large ring buffer sizes, potentially forcing allocations up to 4 GiB per connection. The vulnerability can lead to denial of service by exhausting collector service resources.
IBM MQ versions 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD contain a vulnerability where an authenticated attacker could cause denial of service or potentially execute arbitrary code. This is due to an integer overflow triggered by processing subscription requests with crafted buffer size values.
A code injection vulnerability exists in NPC-Worldwide npcpy versions up to 2.1.27 in the load_sft_model function due to unsafe handling of the base_model_name_or_path argument. This vulnerability can be exploited remotely and has publicly disclosed exploit code. The CVSS score is 6.3, indicating medium severity.
A critical path traversal vulnerability exists in the Comfast CF-WR632AX version 2.6.0.1 within the Multipart Parser component of the /usr/bin/webmgnt file. This vulnerability allows remote attackers to manipulate the filename argument to traverse directories. Exploit code is publicly available, and the vendor has not responded to disclosure attempts.
Joi versions 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contain a prototype pollution vulnerability in the lib/messages.js file. The vulnerability arises because the compile() and merge() functions fail to reject a __proto__ language key. This allows attackers to supply untrusted message configurations that can replace the compiled messages prototype, potentially altering or breaking validation error rendering and any dependent logic.
IBM MQ versions 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD contain a vulnerability that allows an authenticated attacker to execute arbitrary code on a Managed File Transfer agent host due to improper validation of metadata during script execution.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain an open redirect vulnerability that could allow a remote authenticated attacker to conduct a phishing attack. The vulnerability requires authentication and user interaction to exploit. The CVSS score is low, indicating limited impact primarily on confidentiality.
CESNET ipfixcol2 versions 2.3.0 up to but not including 2.9.0 contain an integer overflow vulnerability in the Forwarder output plugin. This flaw allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping 16-bit message length counters. Attackers can send large data sets and templates to a collector forwarding over TCP, causing crashes and potentially writing 2-byte values to attacker-controlled memory addresses.
A server-side request forgery (SSRF) vulnerability exists in DataLinkDC Dinky up to version 1.2.5 in the FlinkWebURITemplateProxyServlet.getNewTargetUri function. This flaw allows remote attackers to manipulate the _authority argument, potentially causing the server to make unintended requests. Exploit code has been published, indicating the vulnerability is exploitable. The issue was reported via a GitHub Security Advisory (GHSA).
Mistral Vibe versions before 2.25.5 on Windows are affected by an untrusted search path vulnerability. This flaw allows attackers to execute arbitrary code by placing a malicious git.exe file in a repository root. When a user opens a crafted repository, components SessionLogger and ProjectContextProvider run the malicious git.exe at session start before any trust prompt appears. The vulnerability has a high severity with a CVSS score of 8.8.
CESNET ipfixcol2 versions 2.7.1 up to but not including 2.9.0 contain a heap-based buffer overflow vulnerability in the Lz4Decoder.cpp component. This flaw allows unauthenticated network peers to write beyond heap buffer boundaries by manipulating buffer size parameters, potentially crashing the collector service. The vulnerability has a high severity score of 7.5 and impacts availability without affecting confidentiality or integrity.
Netrek-client-cow versions through 3.3.3 have an out-of-bounds read vulnerability in the short.c handleSMessage() function. This flaw allows malicious Netrek servers or attackers intercepting the TCP connection to send crafted SP_S_MESSAGE packets with an m_recpt index of 36 or higher, causing the client to read beyond the bounds of internal arrays. This results in a denial of service by crashing the client application.
A heap buffer overflow vulnerability exists in the reSIProcate reTurn client through version 1.14.0 in the TurnTcpSocket::handleReadHeader() function. This flaw allows malicious TURN servers to send STUN or ChannelData frames with oversized declared lengths, causing memory overwrite beyond the fixed buffer size and leading to client crashes.
netrek-client-cow versions through 3.3.3 have a stack-based buffer overflow vulnerability in the handleSMessage() function within short.c. This flaw allows malicious Netrek servers or man-in-the-middle attackers on the plaintext TCP connection to send oversized SP_S_MESSAGE packets that overflow a 100-byte stack buffer, potentially crashing the client application.
go-chi chi versions 5.2.2 through 5.5.0 contain an open redirect vulnerability in the RedirectSlashes middleware. This flaw allows attackers to craft URLs with embedded tab characters that bypass existing fixes and redirect users to external hosts. The vulnerability exploits how browsers handle URL-encoded tabs in the 301 Location header, enabling protocol-relative URL redirection.