A vulnerability in MariaDB server versions from 10.6.1 up to but not including 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2 allows a low-privileged attacker to change another account's password due to improper handling of an empty password in the GRANT PROXY statement. This flaw is fixed in the specified versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
A missing authorization vulnerability exists in the MariaDB server's CONNECT engine plugin file-access UDFs (json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file()) in certain versions. These functions do not enforce the FILE privilege or the secure_file_priv setting, allowing a low-privileged attacker to read or write files on the filesystem that the database account is not authorized to access, subject to OS permissions. The issue affects multiple MariaDB versions and has been fixed in later releases.
GitLab CE/EE versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 contain an integer overflow or wraparound vulnerability. This flaw allows an unauthenticated user to execute arbitrary code on the GitLab server by leveraging a specially crafted regular expression in a CI/CD configuration due to insufficient validation. The issue has been remediated in versions 19.2.8, 19.3.5, and 19.4.2.
Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Because those rules are stored by Loki rather than by Grafana, the change took effect for every user of that Loki data source, not only for the Viewer who made the request.
Exploitation requires an authenticated Viewer account on the Grafana instance and a configured Loki data source; no other privileges are needed. Both Grafana OSS and Grafana Enterprise are affected. The defect is in Grafana's data source proxy; Loki itself is not vulnerable and does not need to be patched.
A race condition vulnerability exists in Python's tempfile.TemporaryDirectory cleanup process. An attacker able to modify the directory tree during cleanup can replace a directory with a symbolic link, leading to deletion or permission changes of files outside the intended temporary directory. This occurs with the privileges of the cleanup process. Systems where shutil.rmtree.avoids_symlink_attacks is false remain vulnerable, and file flags may be reset outside the temporary directory on all platforms.
A vulnerability in PHP's HTTP stream wrapper causes an out-of-bounds read when following a redirect with an empty Location header. This flaw allows a malicious server to influence the redirect target by controlling a byte read past the buffer boundary. The issue affects multiple PHP 8.x versions and has been fixed in recent releases.
A vulnerability in PHP stream filters convert.base64-encode, convert.quoted-printable-encode, and convert.quoted-printable-decode allows out-of-bounds read and information leak when the line-break-chars option contains a NUL byte. This occurs because the length of the line-break-chars is tracked separately from the string, and the duplication function stops at the first NUL byte but retains the original length, causing reads beyond the allocated buffer.
PHP's OpenSSL stream peer verification improperly falls back to the certificate's Common Name (CN) when no subjectAltName (SAN) matches the requested hostname. This behavior violates RFC 6125, which requires ignoring the CN if any SAN is present. As a result, a certificate trusted for one name can be misused to impersonate another, potentially allowing man-in-the-middle attacks.
A vulnerability in PHP's FastCGI implementation allows IPv6 ACL bypass due to partial address comparison. The listen.allowed_clients setting compares only the first 12 bytes of a 16-byte IPv6 address, effectively matching on a /96 prefix rather than the full address. This allows an attacker with an IPv6 address sharing the first 96 bits with an allowed client to bypass access controls and reach the FastCGI endpoint.
A heap-buffer-overflow vulnerability exists in the PHP function php_openssl_matches_wildcard_name() when processing TLS server certificates with wildcard names longer than the hostname being verified. This flaw allows a malicious server to cause the PHP client to read memory beyond the allocated heap buffer. The vulnerability is reachable by default because peer name verification is enabled by default in PHP client streams. It affects multiple PHP versions prior to fixed releases.
PHP's http:// stream wrapper improperly forwards user-supplied Authorization, Cookie, and Proxy-Authorization headers unchanged when following redirects, even across different hosts, ports, or protocol downgrades from HTTPS to HTTP. This can lead to unintended credential disclosure to servers controlling the redirect. The issue affects multiple PHP 8.x versions and has been fixed in recent updates.
A vulnerability in the PHP SOAP XML parser allows unauthenticated attackers to cause unbounded recursion in the cleanup_xml_node function by sending SOAP requests with deeply nested XML elements. This can exhaust the stack and crash the SoapServer process. The issue also affects the SOAP value decoder and WSDL node search helper. Fixed versions are available.
A vulnerability in PHP's phar_tar_number() function allows an integer overflow when parsing the octal size field of a TAR header. This overflow causes the parser to skip an incorrect number of data blocks, enabling crafted archives to inject fake entries that are treated as genuine by PharData during extraction. This issue affects multiple PHP 8.x versions and has been fixed in recent releases.
PHP on Windows does not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$, and CONOUT$ when used in file or stream paths. This allows an attacker to cause the PHP application to open a device instead of a regular file, potentially blocking or hanging requests and exhausting worker processes. This vulnerability affects multiple PHP versions prior to fixed releases.
A vulnerability in PHP's SOAP HTTP client allows a heap buffer overflow due to an integer overflow in buffer size checks. This occurs because the check relies on signed integer overflow, which is undefined behavior and may be optimized away, enabling a malicious SOAP server to cause the client to allocate an insufficient buffer and then overflow it.
A vulnerability in PHP's mysqlnd wire protocol parser allows reading beyond the end of server packets due to insufficient length checks. This can cause undefined behavior including process crashes when interacting with a malicious or compromised MySQL server. The issue affects multiple PHP versions prior to fixed releases.