Incus versions before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 have a missing authorization vulnerability in the GET /1.0/operations/{uuid} endpoint. This flaw allows project-restricted clients to access operations from other projects if they possess a restricted certificate and know a valid operation UUID. Sensitive information such as command lines, environment secrets, websocket secrets, and trust enrolment tokens can be exposed. The vulnerability has a CVSS score of 6.3, indicating medium severity.
Incus versions from 7.3.0 up to but not including 7.5.0 contain a vulnerability that allows restricted project users to bypass project restrictions. This flaw enables such users to set the block.create_options parameter through volume update, copy, and move operations. By setting this option on a custom volume and then triggering a copy or move onto a formatting pool, attackers can inject arguments into the mkfs command executed with root privileges.
Incus versions 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contain an improper authorization vulnerability. This flaw allows restricted TLS clients to access storage bucket keys in the default project. Exploiting this, attackers can retrieve S3 access and secret keys, enabling them to read, modify, or delete objects within those buckets.
Incus versions 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contain a restriction bypass vulnerability. This flaw allows restricted project users with instance creation rights to send refresh migration requests that cause the server to open outbound TLS websocket connections, potentially probing reachable services. The vulnerability has a medium severity with a CVSS score of 4.3.
Mistune versions before 3.3.0 have a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by using ../ sequences in include paths. Additionally, attackers can inject HTML through unescaped error messages and included file contents, enabling cross-site scripting (XSS) even when escape=True is set. This vulnerability has a high severity with a CVSS score of 7.5.
Mistune versions before 3.3.0 have a path traversal vulnerability in the optional Include directive. This flaw allows attackers to read arbitrary local files by providing relative or absolute paths during Markdown rendering. Exploitation can lead to disclosure of sensitive files such as /etc/passwd and injection of unescaped HTML or script content into the rendered output.
Mistune versions before 3.3.0 have a path traversal vulnerability in the RST include directive. This flaw allows attackers to craft markdown with include directives that reference relative or absolute paths, enabling them to read arbitrary files. Sensitive files such as credentials or environment data can be exposed in the rendered HTML output. The vulnerability has a high severity with a CVSS score of 8.6.
Mistune versions before 3.3.0 have an algorithmic complexity vulnerability in the inline link parser. This flaw allows unauthenticated attackers to exhaust CPU resources by submitting markdown inputs with long sequences of unmatched '[' characters. The vulnerability causes the parser to perform O(N^2) operations, significantly delaying rendering and occupying worker threads for extended periods.
Mistune versions from 3.2.1 up to but not including 3.3.0 contain a CSS injection vulnerability. This flaw allows attackers who can control markdown input to inject arbitrary CSS style declarations via the unvalidated figwidth option of the figure directive. Exploitation can cause victim browsers to send requests to attacker-controlled servers, potentially leaking attribute values. The vulnerability has a medium severity rating with a CVSS score of 4.7.
Mistune versions before 3.3.0 have a cross-site scripting (XSS) vulnerability in the Include directive. This flaw occurs because included .html, .xhtml, or .htm files are emitted as raw HTML tokens without proper escaping. An attacker who can place a readable HTML file on the system and leverage path traversal can cause stored scripts to execute if escape=False is set in the renderer.
Mistune versions from 3.0.0 up to but not including 3.3.0 contain an algorithmic complexity denial of service (DoS) vulnerability in the parse_link_text function. This flaw allows attackers to craft markdown input with deeply nested square brackets that cause quadratic parsing time, leading to excessive CPU consumption and potential service disruption.
Mistune versions from 3.0.0 up to but not including 3.3.0 contain an algorithmic complexity vulnerability in the inline link parser's parse_link_text function. This flaw allows unauthenticated attackers to cause high CPU usage by submitting Markdown with many unbalanced '[' or '![' characters, resulting in repeated unbounded forward scans that can tie up worker processes for minutes. The vulnerability has a high severity with a CVSS score of 7.5.
Mistune versions before 3.3.0 have an inefficient algorithmic complexity vulnerability in the parse_link_text function. This flaw allows remote attackers to cause denial of service by submitting markdown with long runs of unmatched square brackets. The vulnerability triggers repeated forward scans in mistune.html(), stalling worker processes for extended periods.
libmongocrypt versions including 1.2.1-1 through 1.20.2-1 contain a vulnerability where requests to external key management services (AWS, Azure, GCP) are constructed by inserting unvalidated values from key vault documents and configurations. A user with write access to the key vault collection can manipulate request structures and signed token claims, potentially causing unintended key management operations.
A 32-bit integer wraparound vulnerability exists in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code. This flaw causes an undersized heap buffer allocation when an excessively long credential value is provided in the client's connection configuration. An attacker controlling the client-side configuration and using the affected authentication mechanism can trigger out-of-bounds writes, potentially corrupting client process memory and causing denial of service. The issue affects only client builds compiled with the Windows-native authentication backend.
A buffer overflow vulnerability exists in the API of AOS-10 that could allow an authenticated adjacent attacker with high privileges to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.
Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.
A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted packets to the affected interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.